CVE-2024-21276: Oracle E-Business Suite Privilege Escalation

CVE-2024-21276 Overview

CVE-2024-21276 is a high-severity authorization flaw in the Oracle Work in Process product of Oracle E-Business Suite, specifically within the Messages component. Supported versions 12.2.3 through 12.2.13 are affected. A low-privileged attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible by Oracle Work in Process. Oracle addressed the issue in its October 2024 Critical Patch Update. The weakness maps to [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated network attackers can read and modify all Oracle Work in Process data, undermining the integrity of manufacturing and production records maintained in Oracle E-Business Suite.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.13
Oracle Work in Process module (component: Messages)
Deployments exposing E-Business Suite HTTP endpoints to authenticated users

Discovery Timeline

2024-10-15 - Oracle publishes the October 2024 Critical Patch Update including CVE-2024-21276
2024-10-15 - CVE-2024-21276 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21276

Vulnerability Analysis

The vulnerability resides in the Messages component of Oracle Work in Process, part of the Oracle E-Business Suite manufacturing stack. An authenticated attacker with only low privileges can send crafted HTTP requests to the affected endpoints and bypass authorization checks. The scope remains unchanged, meaning the attacker acts within the vulnerable component, but the confidentiality and integrity impact on Work in Process data is high. Availability is not affected, indicating the flaw does not crash or disrupt the service. The vulnerability is network-reachable and requires no user interaction, making automated abuse against internet-exposed E-Business Suite instances a realistic concern. The current EPSS probability sits at 0.441%.

Root Cause

The underlying weakness is incorrect authorization ([CWE-863]) in the Messages component. Requests that should be restricted to specific roles or object owners are processed without enforcing the intended access control policy. As a result, any authenticated user with baseline application access can reach functionality that reads or mutates Work in Process records belonging to other users or organizations.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle E-Business Suite web tier. The attacker authenticates with a low-privileged application account, then issues requests to the vulnerable Messages functionality within Oracle Work in Process. Oracle has not publicly released technical exploitation details, and no public proof-of-concept or CISA KEV listing exists at this time. See the Oracle Security Alert - October 2024 for advisory-level information.

// No verified public exploit code is available for CVE-2024-21276.
// Refer to Oracle's October 2024 Critical Patch Update advisory for guidance.

Detection Methods for CVE-2024-21276

Indicators of Compromise

Unexpected creation, modification, or deletion of Work in Process job, operation, or message records by low-privileged accounts
HTTP requests from unusual source IPs to Oracle E-Business Suite endpoints associated with the Work in Process Messages component
Application audit entries showing cross-organization or cross-owner data access by accounts without a legitimate business role

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On and Page Access audit logs for anomalous access patterns to Work in Process pages
Correlate application-tier access logs with database audit records to identify write operations that lack a corresponding authorized user workflow
Baseline normal Work in Process transaction volumes per user role and alert on statistical deviations

Monitoring Recommendations

Forward Oracle E-Business Suite Apache/OHS access logs and FND audit tables to a central SIEM for correlation
Alert on repeated HTTP requests to Work in Process Messages URLs from a single low-privileged session
Monitor for schema-level changes to WIP tables outside of scheduled batch or MRP processes

How to Mitigate CVE-2024-21276

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update - October 2024 to all Oracle E-Business Suite 12.2.3-12.2.13 environments
Inventory internet-exposed E-Business Suite instances and prioritize patching those first
Rotate credentials for low-privileged application accounts if audit logs show suspicious Work in Process activity prior to patching

Patch Information

Oracle released the fix for CVE-2024-21276 as part of the October 2024 Critical Patch Update. Administrators must apply the E-Business Suite patch bundle referenced in the Oracle Security Alert - October 2024 that corresponds to their installed release (12.2.3 through 12.2.13). Oracle does not support partial or backported fixes outside of the CPU delivery.

Workarounds

Restrict network access to the E-Business Suite web tier so that only trusted corporate networks or VPN users can reach HTTP endpoints
Enforce least privilege on Oracle E-Business Suite responsibilities and remove Work in Process access from accounts that do not require it
Place a Web Application Firewall in front of the E-Business Suite web tier and monitor requests to Work in Process URLs until patches are deployed

bash

# Example: verify the applied October 2024 CPU patch level on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_OCT_2024_PATCH_ID>')
 ORDER BY last_update_date DESC;
EOF