CVE-2026-60521 affects Oracle Advanced Pricing in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to gain unauthorized update, insert, delete, and read access to some Oracle Advanced Pricing data. The vulnerability is classified under CWE-284 (Improper Access Control). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality and integrity impacts and no availability impact. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this vulnerability. Customers are advised to review the advisory and apply relevant patches.

Successful exploitation allows an unauthenticated attacker to read and modify certain data within Oracle Advanced Pricing, potentially leading to unauthorized data disclosure and unauthorized data modification. There is no reported impact on system availability. The vulnerability affects confidentiality and integrity of data accessible through Oracle Advanced Pricing.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-60521, customers should promptly review and apply the July 2026 Critical Patch Update and any subsequent patches for Oracle Advanced Pricing to mitigate this vulnerability. Staying on actively supported versions and timely patching is strongly recommended by Oracle. Patch status is not yet confirmed explicitly for this vulnerability; check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.