CVE-2026-60863 affects Oracle Advanced Pricing versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the Oracle Advanced Pricing component of Oracle E-Business Suite. Successful exploitation can lead to complete takeover of the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (8.8 base score). The July 2026 Oracle Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle advises customers to remain on supported versions and apply patches without delay.

This vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Advanced Pricing, impacting confidentiality, integrity, and availability of the product. Such compromise could lead to unauthorized access, data manipulation, and service disruption within Oracle Advanced Pricing environments.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. However, the vendor advisory does not explicitly confirm the patch status for CVE-2026-60863. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.