CVE-2026-60868 affects Oracle Advanced Pricing in Oracle E-Business Suite versions 12.2.14 and 12.2.15. It is a difficult to exploit vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability may also affect additional products due to scope change. Exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data accessible through Oracle Advanced Pricing. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Advanced Pricing and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, additional Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-60868. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle Advanced Pricing interfaces and monitor for unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.