CVE-2026-60340: Oracle Project Costing Privilege Escalation

CVE-2026-60340 Overview

CVE-2026-60340 affects the Oracle Project Costing product within Oracle E-Business Suite, specifically the Enterprise Command Center component. Supported versions 12.2.3 through 12.2.15 are affected. An authenticated attacker with high privileges and network access via HTTP can compromise Oracle Project Costing. Successful exploitation results in complete takeover of the Oracle Project Costing module, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation enables complete takeover of Oracle Project Costing, allowing attackers to read, modify, and disrupt financial project data across the enterprise.

Affected Products

Oracle E-Business Suite — Oracle Project Costing 12.2.3
Oracle E-Business Suite — Oracle Project Costing versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Costing 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60340 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60340

Vulnerability Analysis

The vulnerability resides in the Enterprise Command Center component of Oracle Project Costing, part of Oracle E-Business Suite (EBS). The Enterprise Command Center framework delivers dashboards and drill-down analytics against Project Costing data over HTTP. An authenticated attacker holding high privileges within EBS can abuse this exposed interface to compromise the Project Costing module. Oracle classifies the outcome as a takeover, meaning the attacker gains full read, write, and disruption capability over the affected product. Exploitation does not require user interaction and follows a low-complexity attack path over the network.

Root Cause

Oracle has not publicly disclosed the underlying flaw class, and no CWE has been assigned in NVD. The advisory attributes the issue to the Enterprise Command Center component in Oracle Project Costing releases 12.2.3 through 12.2.15. Because the scope remains unchanged and privileges are required, the defect likely involves insufficient enforcement of trust boundaries within an authenticated command-center workflow rather than an unauthenticated entry point.

Attack Vector

An attacker must authenticate to Oracle E-Business Suite with high-privilege credentials, then send crafted HTTP requests to the Enterprise Command Center endpoints exposed by Project Costing. Credentials may be obtained through phishing, credential reuse, or lateral movement from a compromised administrative workstation. Public proof-of-concept code is not available, and the EPSS score of 0.34% reflects low near-term exploitation probability. No verified exploitation code is available for this vulnerability. Refer to the Oracle CPU July 2026 Alert for authoritative technical details.

Detection Methods for CVE-2026-60340

Indicators of Compromise

Unexpected HTTP requests to Enterprise Command Center endpoints under the Project Costing module from high-privileged accounts outside normal working hours.
New or modified Project Costing configurations, expenditure records, or cost distributions performed by administrative accounts that do not normally use the Command Center interface.
EBS FND_LOG_MESSAGES and application tier access logs showing anomalous session activity for SYSADMIN or Project Costing responsibility holders.

Detection Strategies

Baseline Enterprise Command Center URL patterns and alert on deviations tied to Project Costing responsibilities.
Correlate EBS application audit logs with network flow data to identify HTTP sessions from unfamiliar source IPs against Project Costing endpoints.
Monitor for privilege changes and responsibility assignments granting Project Costing access, particularly outside change-management windows.

Monitoring Recommendations

Forward EBS application, database, and WebLogic managed-server logs to a central SIEM for correlation and retention.
Enable Oracle EBS Sign-On Audit and Page Access Tracking for the Project Costing module to capture user activity granularly.
Alert on repeated authentication failures followed by success for accounts with Project Costing privileges, which may indicate credential compromise preceding exploitation.

How to Mitigate CVE-2026-60340

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Project Costing.
Inventory high-privileged EBS accounts with Project Costing or Enterprise Command Center responsibilities and reduce membership to the minimum required.
Rotate credentials for accounts with administrative access to the Project Costing module.

Patch Information

Oracle released fixes for CVE-2026-60340 in the July 2026 Critical Patch Update. Consult the Oracle CPU July 2026 Alert for the specific patch bundle identifiers applicable to your EBS release train, and validate patches in a non-production environment before promotion.

Workarounds

Restrict network reachability to Enterprise Command Center endpoints using a reverse proxy or web application firewall, allowing only trusted management networks.
Enforce multi-factor authentication (MFA) for all EBS administrator and Project Costing responsibility holders to raise the bar for credential abuse.
Temporarily disable unused Enterprise Command Center dashboards within Project Costing until the CPU patch is deployed.

bash

# Example: restrict access to EBS Enterprise Command Center paths at the reverse proxy
# (Apache httpd fronting Oracle E-Business Suite)
<Location "/OA_HTML/enterpriseCommandCenter">
    Require ip 10.10.20.0/24
    Require ip 10.10.30.0/24
</Location>

<Location "/OA_HTML/RF.jsp">
    Require valid-user
    Require ip 10.10.20.0/24
</Location>