CVE-2026-61304: Oracle Price Protection Auth Bypass Flaw

CVE-2026-61304 Overview

CVE-2026-61304 affects the Oracle Price Protection product within Oracle E-Business Suite, specifically the Internal Operations component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle Price Protection. Successful exploitation permits unauthorized update, insert, or delete access to a subset of accessible data, unauthorized read access to a subset of data, and a partial denial of service condition. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Authenticated attackers with low privileges can achieve unauthorized data modification, limited data disclosure, and partial denial of service against Oracle Price Protection over the network via HTTP.

Affected Products

Oracle E-Business Suite - Oracle Price Protection version 12.2.3
Oracle E-Business Suite - Oracle Price Protection versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Price Protection version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-61304 published to NVD as part of the Oracle Critical Patch Update July 2026
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61304

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Price Protection, a module of Oracle E-Business Suite used for managing pricing agreements and reimbursement processing. Oracle classifies the issue as easily exploitable over HTTP by an attacker holding low-privileged credentials. Impact spans all three security properties: confidentiality, integrity, and availability, though each is limited in scope.

Oracle's advisory maps the flaw to [CWE-200], indicating that the underlying weakness involves exposure of information to actors who should not have access. The combined integrity and availability impacts suggest the affected code path also lacks sufficient authorization checks on state-changing operations, allowing modification and disruption beyond mere information disclosure.

Root Cause

Oracle has not published deep technical detail. Based on the [CWE-200] mapping and the described impacts, the root cause involves insufficient access control enforcement within an HTTP-accessible interface of the Price Protection module. The component fails to properly restrict which authenticated users can read or manipulate specific pricing-related records.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. No user interaction is required and attack complexity is low. Once authenticated, an attacker sends crafted HTTP requests to Price Protection endpoints to read, modify, or delete records they should not be able to touch, or to trigger conditions that partially degrade the service.

No public proof-of-concept exploit is available. The EPSS probability is 0.272% (percentile 19.252) as of 2026-07-22, indicating a low near-term likelihood of observed exploitation.

See the Oracle Critical Patch Update July 2026 for the authoritative advisory.

Detection Methods for CVE-2026-61304

Indicators of Compromise

Unexpected HTTP requests to Oracle Price Protection URLs from accounts that do not routinely perform pricing operations.
Anomalous INSERT, UPDATE, or DELETE activity in Price Protection database tables outside normal business processes.
Repeated HTTP 500 or timeout responses from Price Protection endpoints suggestive of partial denial of service attempts.

Detection Strategies

Enable and review Oracle E-Business Suite application audit logs for Price Protection module access by low-privileged users.
Correlate web server access logs against a baseline of normal Price Protection request patterns and flag deviations.
Enable database-level auditing on Price Protection schema objects to record data modification events with user attribution.

Monitoring Recommendations

Monitor authentication events for low-privileged accounts accessing modules outside their assigned job function.
Track volume and error rates on Price Protection HTTP endpoints to identify probing or partial DoS attempts.
Alert on any bulk data modification operations against Price Protection tables performed outside change windows.

How to Mitigate CVE-2026-61304

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite instances and confirm which host the Oracle Price Protection module.
Review and tighten role assignments so that only required users hold responsibilities granting Price Protection access.

Patch Information

Oracle addresses CVE-2026-61304 in the Oracle Critical Patch Update July 2026. Customers running supported versions 12.2.3 through 12.2.15 must apply the corresponding patch bundle from My Oracle Support. Oracle recommends applying Critical Patch Updates without delay, as unpatched systems remain exposed to publicly documented vulnerabilities.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so only trusted internal networks and VPN users can reach the application tier.
Disable or restrict responsibilities granting access to Oracle Price Protection for accounts that do not require it until patches are applied.
Place a web application firewall in front of the E-Business Suite application tier and enforce authentication and rate-limiting on Price Protection URLs.

bash

# Example: apply Oracle CPU July 2026 patch using adop (EBS 12.2 online patching)
# Reference: Oracle Critical Patch Update July 2026 advisory
source $EBS_APPS_ENV
adop phase=prepare
adop phase=apply patches=<CPUJUL2026_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup