This vulnerability exists in the Pricing Installation component of Oracle Advanced Pricing within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges who can access the system over HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Advanced Pricing. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no impact on availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches across Oracle products but does not explicitly confirm the patch availability or remediation status for this specific vulnerability in Oracle Advanced Pricing.

The vulnerability allows unauthorized access to critical data within Oracle Advanced Pricing, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of sensitive pricing data managed by the product. There is no reported impact on availability. The high CVSS score reflects the significant risk posed by this vulnerability if exploited.

Oracle has released a Critical Patch Update advisory in July 2026 that includes security patches for multiple products. However, the advisory content provided does not explicitly confirm a patch or remediation for CVE-2026-60867 in Oracle Advanced Pricing. Therefore, patch status is not yet confirmed — users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities.