CVE-2026-60154: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60154 Overview

CVE-2026-60154 affects the Oracle Application Object Library (FND) component of Oracle E-Business Suite. The flaw impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness to compromise the Application Object Library.

Successful exploitation grants unauthorized update, insert, or delete access to a portion of Application Object Library data. Attackers also gain unauthorized read access to a subset of that data. The weakness is categorized under improper access control [CWE-284].

Critical Impact
Authenticated attackers can modify and read a subset of Oracle Application Object Library data over the network, affecting confidentiality and integrity of E-Business Suite deployments.

Affected Products

Oracle E-Business Suite - Application Object Library 12.2.3
Oracle E-Business Suite - Application Object Library versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Application Object Library 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60154 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60154

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Application Object Library, which provides shared services such as security, session management, and data access to Oracle E-Business Suite modules. An improper access control condition [CWE-284] allows an authenticated user to reach functionality or data that should be restricted.

Exploitation requires network access over HTTP and low privileges, meaning any user with a valid low-tier E-Business Suite account can attempt the attack. No user interaction is required, and the attack complexity is low. The scope remains unchanged, so impact is limited to resources managed by the Application Object Library itself.

The impact profile shows partial confidentiality and integrity loss without availability effects. Attackers can read a subset of protected data and perform unauthorized create, update, or delete operations on some records.

Root Cause

The root cause is improper access control within the Core module of the Application Object Library. Authorization checks fail to fully restrict actions or data reads for accounts that hold only baseline privileges within the E-Business Suite environment.

Attack Vector

The attack vector is network based over HTTP against the Oracle E-Business Suite web tier. An attacker authenticates with a low-privileged account, then issues crafted requests to Application Object Library endpoints to reach data or actions outside the intended authorization boundary. Refer to the Oracle Security Alert July 2026 for advisory details.

No verified public exploit code or proof-of-concept has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.24%.

Detection Methods for CVE-2026-60154

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite user sessions targeting Application Object Library (FND) endpoints.
Database audit records showing insert, update, or delete operations on FND_* tables by accounts that historically only perform reads.
Anomalous read volume against Application Object Library resources from a single user session or IP address.

Detection Strategies

Enable Oracle E-Business Suite sign-on audit and page access tracking to record user navigation to Application Object Library functions.
Correlate application-tier HTTP access logs with database audit logs to identify privilege boundary violations.
Alert on any modification of Application Object Library configuration or profile data outside of change windows.

Monitoring Recommendations

Monitor authentication events for low-privileged accounts that suddenly access administrative or shared services URLs.
Track outbound HTTP responses from E-Business Suite for abnormal payload sizes indicating bulk data extraction.
Review Oracle Fusion Middleware and WebLogic access logs for repeated 200 responses on FND endpoints from non-administrative accounts.

How to Mitigate CVE-2026-60154

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite as documented in the Oracle Security Alert July 2026.
Inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and prioritize patching internet-facing tiers.
Review Application Object Library user accounts and remove or restrict low-privileged accounts that no longer require access.

Patch Information

Oracle released fixes for CVE-2026-60154 as part of the Oracle Critical Patch Update advisory published in July 2026. Administrators must download and apply the E-Business Suite patches referenced in the Oracle Security Alert July 2026 that correspond to their installed version between 12.2.3 and 12.2.15.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier using a web application firewall or reverse proxy allowlist until patches are applied.
Enforce least-privilege responsibilities and menus for Application Object Library users to limit reachable functions.
Increase database and application audit verbosity on FND_* objects to detect exploitation attempts while patch deployment is in progress.

bash

# Configuration example: enable sign-on audit at USER level in Oracle E-Business Suite
# Set the following profile option via System Administrator responsibility
Profile Option: Sign-On:Audit Level
Site Value:     USER

# Verify current profile value using SQL*Plus
SELECT profile_option_value
  FROM fnd_profile_option_values
 WHERE profile_option_id = (
       SELECT profile_option_id
         FROM fnd_profile_options
        WHERE profile_option_name = 'SIGNONAUDIT'
       );