CVE-2026-61334: Oracle Price Protection Auth Bypass Flaw

CVE-2026-61334 Overview

CVE-2026-61334 is a high-severity access control weakness [CWE-284] in the Oracle Price Protection product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue without user interaction.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data across all Oracle Price Protection accessible data. Attackers can also read a subset of Price Protection data, breaking both integrity and confidentiality guarantees.

Critical Impact
Authenticated attackers with minimal privileges can tamper with pricing and rebate data used by downstream financial processes, producing incorrect payouts and audit trail corruption.

Affected Products

Oracle E-Business Suite — Oracle Price Protection 12.2.3 through 12.2.15
Component: Internal Operations
Deployments exposing Oracle E-Business Suite HTTP endpoints to internal or external networks

Discovery Timeline

2026-07-21 - CVE-2026-61334 published to NVD
2026-07-22 - Last updated in NVD database
Oracle addressed the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61334

Vulnerability Analysis

The vulnerability is classified under CWE-284 (Improper Access Control). The Internal Operations component of Oracle Price Protection fails to enforce sufficient authorization checks on requests that mutate pricing records. An authenticated user with low privileges can invoke operations that should be restricted to privileged roles.

Because the attack traverses HTTP, any user who can authenticate to the E-Business Suite front end can reach the vulnerable code path. No social engineering or client-side interaction is required.

Exploitation produces high integrity impact and low confidentiality impact. Availability is not affected. The attacker can create, alter, or delete price protection records and read a limited subset of related data.

Root Cause

The root cause is missing or incomplete authorization enforcement in the Internal Operations handlers of the Price Protection module. Oracle has not published implementation-level details. The CWE-284 classification indicates that access decisions rely on assumptions about caller identity or role that the application does not verify at the request boundary.

Attack Vector

An attacker authenticates to Oracle E-Business Suite using a low-privileged account. The attacker then issues crafted HTTP requests to Price Protection endpoints exposed under the Internal Operations component. The server processes these requests without validating that the caller holds the required functional role, allowing unauthorized data modification.

No verified proof-of-concept code has been published. Public exploitation has not been reported by CISA KEV or Oracle. The EPSS probability at publication is 0.296%.

For technical details, consult the Oracle Security Alert July 2026.

Detection Methods for CVE-2026-61334

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE activity on Price Protection tables originating from low-privileged application accounts.
HTTP requests to Price Protection Internal Operations URLs from user sessions that historically never accessed these endpoints.
Application audit records showing price adjustments, rebate changes, or record deletions outside of normal business workflows.

Detection Strategies

Correlate Oracle E-Business Suite FND_LOGINS and functional audit tables with Price Protection object changes to identify role-inconsistent activity.
Baseline normal user-to-endpoint mappings for /OA_HTML/ Price Protection URLs and alert on deviations.
Enable and forward Oracle E-Business Suite Sign-On Audit and Function Security audit to a centralized SIEM for anomaly analysis.

Monitoring Recommendations

Ingest Oracle E-Business Suite application, database, and web tier logs into a centralized analytics platform with retention aligned to financial audit requirements.
Monitor database-level DML on Price Protection schema objects and alert on activity from application service accounts outside change windows.
Track failed and successful authorization events on Internal Operations functions to identify probing behavior.

How to Mitigate CVE-2026-61334

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.x instances running Price Protection.
Inventory all low-privileged accounts with access to the Price Protection responsibility and remove entitlements that are not required.
Review Price Protection data changes made in the 30 days preceding patch application for signs of unauthorized modification.

Patch Information

Oracle released a fix as part of the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the specific patch identifiers that apply to your Oracle E-Business Suite 12.2.3–12.2.15 deployment. Apply patches in a test environment before production rollout and validate Price Protection workflows post-patch.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using perimeter and internal segmentation controls until the patch is applied.
Remove the Price Protection responsibility from any user role that does not require it, minimizing the pool of accounts that can reach the vulnerable functions.
Enable Function Security auditing on Price Protection menus to record every access attempt for forensic review.