CVE-2026-60870 affects Oracle Advanced Pricing versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that permits a low privileged attacker with network access via HTTP to compromise the Oracle Advanced Pricing component of Oracle E-Business Suite. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Advanced Pricing, as well as unauthorized update, insert, or delete operations on some of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this vulnerability.

The vulnerability allows unauthorized access to critical data within Oracle Advanced Pricing and permits unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is applied, restrict network access to Oracle Advanced Pricing interfaces to trusted users only and monitor for suspicious activity related to data access or modification.