CVE-2026-47028: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-47028 Overview

CVE-2026-47028 is an access control vulnerability [CWE-284] in the Oracle Document Management and Collaboration product of Oracle E-Business Suite. The flaw resides in the Attachments component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation permits unauthorized read, create, delete, or modification access to all data accessible through Oracle Document Management and Collaboration.

Critical Impact
An authenticated attacker can read, alter, or destroy documents managed by the Attachments component across the entire Oracle E-Business Suite deployment.

Affected Products

Oracle E-Business Suite — Oracle Document Management and Collaboration, versions 12.2.3 through 12.2.15
Component: Attachments
Deployments exposing the E-Business Suite web tier over HTTP/HTTPS

Discovery Timeline

2026-07-21 - CVE-2026-47028 published to the National Vulnerability Database
2026-07-21 - Oracle publishes the fix in the Oracle Security Alert July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47028

Vulnerability Analysis

The vulnerability is categorized as Improper Access Control [CWE-284] within the Attachments component of Oracle Document Management and Collaboration. The Attachments framework in Oracle E-Business Suite manages file uploads, downloads, and metadata linked to business objects such as orders, invoices, and requisitions. Missing or insufficient authorization checks in this component allow a user with only a basic authenticated session to reach documents and metadata belonging to other users or business contexts.

Exploitation is straightforward over HTTP and does not require user interaction. The scope is unchanged, which means the compromise is contained within the vulnerable component, but the confidentiality and integrity impacts within that component are high. Availability is not affected according to the CVSS vector published by Oracle.

Root Cause

The root cause is an authorization gap in the Attachments component. Requests that retrieve or modify attachment records are not consistently validated against the requesting user's entitlement to the underlying business object. Any authenticated E-Business Suite user session can therefore submit requests that reference attachments outside their intended scope.

Attack Vector

The attack vector is network-based via HTTP against the E-Business Suite web tier. An attacker requires valid low-privilege credentials, such as those assigned to a standard self-service user. Once authenticated, the attacker issues crafted requests to the Attachments endpoints to enumerate, download, replace, or delete document records managed by Oracle Document Management and Collaboration. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-47028

Indicators of Compromise

Unexpected HTTP requests to Attachments-related URLs such as those containing fndAttachment, AttachmentImageServlet, or fnd_lobs in the E-Business Suite access logs
Authenticated sessions from low-privilege accounts issuing large volumes of attachment enumeration requests
Attachment records created, updated, or deleted outside of expected business workflows or by users lacking role-based document ownership

Detection Strategies

Review E-Business Suite audit tables and FND_LOGINS for low-privilege accounts accessing documents outside their functional responsibility
Correlate application server access logs with the FND_ATTACHED_DOCUMENTS and FND_LOBS tables to identify attachment access without a matching business transaction
Baseline typical Attachments traffic per user role and alert on deviations in request volume, target object types, or off-hours activity

Monitoring Recommendations

Forward Oracle HTTP Server and WebLogic access logs to a centralized analytics platform for continuous review
Enable Oracle E-Business Suite Sign-On Audit and page-level audit for the Attachments component
Alert on privileged database queries against FND_LOBS and FND_DOCUMENTS originating from application accounts outside normal patterns

How to Mitigate CVE-2026-47028

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15
Inventory user accounts with access to the E-Business Suite web tier and disable dormant or unnecessary low-privilege accounts
Restrict network exposure of the E-Business Suite web tier so that only trusted networks can reach the Attachments endpoints

Patch Information

Oracle addressed CVE-2026-47028 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 advisory for the specific patch identifiers, prerequisites, and post-installation validation steps for Oracle E-Business Suite 12.2.x.

Workarounds

Place the E-Business Suite web tier behind a reverse proxy or web application firewall that enforces authentication and rate limiting on Attachments endpoints
Reduce the number of responsibilities and menus that expose the Attachments framework to end users until patching is complete
Increase auditing on FND_ATTACHED_DOCUMENTS, FND_DOCUMENTS, and FND_LOBS to detect misuse while the patch window is scheduled

bash

# Verify current Oracle E-Business Suite patch level before and after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<july_2026_cpu_bug_id>')
 ORDER BY last_update_date DESC;
EOF