CVE-2026-61329: Oracle Price Protection Auth Bypass Flaw

CVE-2026-61329 Overview

CVE-2026-61329 affects the Oracle Price Protection product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are impacted. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise Oracle Price Protection. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible by the product. The flaw maps to [CWE-284] Improper Access Control and was published to the National Vulnerability Database (NVD) on 2026-07-21.

Critical Impact
Authenticated attackers can read, modify, or delete all data accessible to Oracle Price Protection over the network.

Affected Products

Oracle E-Business Suite — Oracle Price Protection 12.2.3
Oracle E-Business Suite — Oracle Price Protection versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Price Protection 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61329 published to NVD alongside the Oracle Critical Patch Update
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61329

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Price Protection. Oracle characterizes it as easily exploitable, requiring only low privileges and no user interaction. An authenticated attacker sending crafted HTTP requests can bypass intended access controls to reach functionality or records beyond their authorization scope.

Exploitation compromises both confidentiality and integrity of data accessible to the Price Protection module. Availability is not impacted according to the vendor advisory. Because Oracle E-Business Suite typically stores financial, pricing, and vendor data, unauthorized modification carries direct business risk including price manipulation, fraudulent claims processing, and tampering with rebate calculations.

Root Cause

The issue is classified under [CWE-284] Improper Access Control. Server-side authorization checks in the Internal Operations component fail to fully enforce the boundary between low-privileged users and privileged data or operations. Oracle has not published implementation details in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold valid, low-privileged credentials to the E-Business Suite instance. No user interaction is required, and the scope is unchanged. Confidentiality and integrity impacts are rated High while availability is rated None.

No public proof-of-concept, exploit code, or exploitation-in-the-wild reporting is associated with this CVE at publication time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-61329

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite user sessions to Oracle Price Protection endpoints under the Internal Operations component.
Application audit records showing create, update, or delete operations on Price Protection data by accounts that do not normally perform such actions.
Anomalous read access to pricing, claim, or rebate records outside a user's assigned operating unit or responsibility.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate user sessions with Price Protection module activity.
Baseline normal HTTP access patterns to /OA_HTML/ Price Protection URLs and alert on deviations from established user roles.
Compare responsibility assignments against actual data modifications recorded in FND_LOGINS, FND_LOGIN_RESPONSIBILITIES, and Price Protection transaction tables.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database audit, and web tier logs to a centralized SIEM for correlation and long-term retention.
Alert on privilege changes, role grants, and unusual bulk data modifications within Price Protection tables.
Monitor for repeated HTTP 200 responses to Price Protection URLs following prior HTTP 403 or authorization failures from the same session.

How to Mitigate CVE-2026-61329

Immediate Actions Required

Apply the fixes delivered in the July 2026 Oracle Critical Patch Update to all E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory user accounts with access to Oracle Price Protection responsibilities and remove entitlements that are not business-required.
Rotate credentials for low-privileged accounts if suspicious Price Protection activity is identified during log review.

Patch Information

Oracle addressed CVE-2026-61329 in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update advisory for patch numbers, prerequisite requirements, and post-installation steps specific to Oracle E-Business Suite 12.2.

Workarounds

Restrict network access to the E-Business Suite HTTP tier so that only trusted internal networks and VPN users can reach Price Protection URLs.
Tighten responsibility and menu assignments to remove Price Protection Internal Operations functions from users who do not require them until patching is complete.
Increase auditing verbosity on Price Protection functions and review activity daily until the Critical Patch Update is applied.

bash

# Configuration example: restrict Price Protection URLs at the Oracle HTTP Server
# Add to the appropriate mod_rewrite or Location block in the EBS web tier
<Location /OA_HTML/OA.jsp>
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>