CVE-2026-60870: Oracle Advanced Pricing Auth Bypass Flaw

CVE-2026-60870 Overview

CVE-2026-60870 is a high-severity vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite, within the Pricing Installation component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability to compromise Oracle Advanced Pricing. Successful exploitation leads to unauthorized access to all Oracle Advanced Pricing accessible data and unauthorized update, insert, or delete access to a subset of that data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can read all Oracle Advanced Pricing data and modify a subset of records over HTTP, threatening the confidentiality and integrity of pricing information in Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite — Oracle Advanced Pricing 12.2.3
Oracle E-Business Suite — Oracle Advanced Pricing versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Advanced Pricing 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60870 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60870

Vulnerability Analysis

The vulnerability resides in the Pricing Installation component of Oracle Advanced Pricing, a module of Oracle E-Business Suite. Oracle rates the issue as easily exploitable, requiring only low privileges and no user interaction. Attackers reach the affected functionality over HTTP, which is the standard transport for E-Business Suite web-tier services.

The primary impact is on confidentiality and integrity. A successful attacker gains complete read access to Oracle Advanced Pricing data and can insert, update, or delete a subset of that data. Availability is not impacted according to Oracle's advisory. The EPSS score at publication was 0.303% (percentile 22.434), indicating no observed exploitation activity so far.

Root Cause

Oracle has not published low-level technical details for CVE-2026-60870. The advisory identifies the defect as residing in the Pricing Installation component and being reachable by an authenticated user account with minimal privileges. The vector characteristics — network access, low complexity, and scope unchanged — are consistent with a server-side access control or input validation flaw in a web-exposed pricing endpoint.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite web tier and a valid low-privileged application account. The attacker issues crafted HTTP requests against the Advanced Pricing Installation component. Because scope is unchanged, the impact stays confined to Oracle Advanced Pricing data, but that data set includes pricing rules, modifiers, and qualifiers that directly influence downstream sales and order management. No user interaction is required, enabling automation once a foothold account is available.

No public proof-of-concept exploit code was available at the time of NVD publication. Refer to the Oracle Critical Patch Update July 2026 advisory for authoritative details.

Detection Methods for CVE-2026-60870

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts targeting Oracle Advanced Pricing URLs, particularly Pricing Installation endpoints.
Anomalous INSERT, UPDATE, or DELETE activity in Advanced Pricing tables such as QP_LIST_HEADERS_B, QP_LIST_LINES, and QP_QUALIFIERS outside change-control windows.
Application audit records showing pricing configuration changes performed by users without a business role in pricing administration.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking, then alert on access to Advanced Pricing forms and OA Framework pages by non-pricing users.
Correlate web-tier access logs with database audit trails to identify HTTP sessions that trigger writes to QP_* schema objects.
Monitor for privilege changes and unusual responsibility assignments granting Advanced Pricing access, which may precede exploitation.

Monitoring Recommendations

Forward E-Business Suite application, web-tier, and database audit logs to a centralized SIEM or data lake for correlation.
Baseline normal Advanced Pricing usage per user and alert on deviations in request volume, data volume returned, or write frequency.
Track authentication events for low-privileged accounts that suddenly access pricing modules, especially from new source IP addresses.

How to Mitigate CVE-2026-60870

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite Advanced Pricing to all environments running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite instances, including non-production and disaster recovery copies, and confirm patch status for each.
Review Advanced Pricing responsibility assignments and revoke access from users who do not require it.
Rotate credentials for any low-privileged accounts flagged in recent audit reviews as potentially exposed.

Patch Information

Oracle addressed CVE-2026-60870 in the Oracle Critical Patch Update - July 2026. Administrators should follow the standard E-Business Suite patch application workflow using AutoPatch (adpatch) or adop for the 12.2 codeline, and validate patch success through the Oracle Applications Manager patch history.

Workarounds

Restrict network access to the E-Business Suite web tier so that only trusted corporate networks and VPN ranges can reach HTTP endpoints.
Tighten Advanced Pricing responsibilities and function security to enforce least privilege on the Pricing Installation component until patches are deployed.
Deploy a web application firewall (WAF) rule set in front of the E-Business Suite web tier to log and rate-limit requests to Advanced Pricing URLs.

bash

# Example: apply Oracle E-Business Suite 12.2 patch via adop
# (replace PATCH_ID with the CPU July 2026 patch identifier from My Oracle Support)
source $APPL_TOP/EBSapps.env run
adop phase=prepare
adop phase=apply patches=PATCH_ID
adop phase=finalize
adop phase=cutover
adop phase=cleanup