CVE-2026-60344: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-60344 Overview

CVE-2026-60344 affects the Oracle HRMS (France) product within Oracle E-Business Suite, specifically the French HR Payroll component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful exploitation permits unauthorized update, insert, or delete access to some Oracle HRMS (France) data, plus unauthorized read access to a subset of accessible data. Oracle disclosed this issue in its July 2026 Critical Patch Update.

Critical Impact
A network-based, low-privileged attacker can modify and read a subset of French HR Payroll data through the affected HTTP interface, impacting confidentiality and integrity of employee payroll records.

Affected Products

Oracle E-Business Suite — Oracle HRMS (France), version 12.2.3
Oracle E-Business Suite — Oracle HRMS (France), versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (France), version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60344 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60344

Vulnerability Analysis

CVE-2026-60344 resides in the French HR Payroll component of Oracle HRMS (France), part of Oracle E-Business Suite. The flaw is reachable over HTTP and requires only low-level authenticated access to the E-Business Suite environment. An attacker with a valid, low-privileged Oracle E-Business Suite account can send crafted HTTP requests to the vulnerable payroll functionality to modify records they should not be able to touch. The impact is scoped: partial confidentiality loss (read access to a subset of data) and partial integrity loss (update, insert, or delete on some data). Availability is not affected, which suggests the underlying weakness is a data-layer authorization or input validation gap rather than a service-disrupting condition. Oracle's July 2026 Critical Patch Update lists this as one of several Oracle E-Business Suite issues addressed in that cycle.

Root Cause

Oracle has not published component-level root cause details beyond the advisory summary. Based on the impact profile — data changes without availability loss, low privileges required, no user interaction — the underlying weakness is consistent with a broken access control or improper input validation flaw in a payroll HTTP endpoint that fails to enforce authorization on data-modifying operations.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold a low-privileged Oracle E-Business Suite account. No user interaction is required, and no scope change occurs. From an authenticated session, the attacker issues crafted HTTP requests to the French HR Payroll functionality to read, insert, update, or delete accessible records.

No verified public exploit code is available for CVE-2026-60344. Refer to the Oracle Security Alert July 2026 for the official advisory.

Detection Methods for CVE-2026-60344

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against French HR Payroll tables originating from low-privileged Oracle E-Business Suite accounts.
HTTP requests from authenticated sessions targeting HRMS (France) payroll endpoints outside normal HR business processes or working hours.
Audit log entries showing data modifications on payroll records without a corresponding approved workflow or change ticket.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for HRMS (France) responsibilities, focusing on users without a legitimate payroll role.
Enable Oracle Database fine-grained auditing on French HR Payroll tables to capture row-level DML activity and correlate it with the invoking application user.
Baseline normal HTTP request patterns to payroll servlets and JSPs, then alert on anomalous request volume or parameter values from non-HR users.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs into a centralized SIEM for correlation across identity, HTTP, and SQL layers.
Alert on privilege changes or responsibility assignments that grant HRMS (France) access to accounts not previously entitled.
Monitor for repeated HTTP 4xx or 5xx responses on French HR Payroll URLs, which can indicate probing before a successful exploit.

How to Mitigate CVE-2026-60344

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running HRMS (France) on versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite environments — production, test, and development — and confirm patch status for each.
Review and tighten user responsibilities and menu assignments granting access to French HR Payroll functionality.
Rotate credentials for any low-privileged accounts suspected of misuse and enforce multi-factor authentication on E-Business Suite logins where supported.

Patch Information

Oracle addressed CVE-2026-60344 in the Oracle Security Alert July 2026 Critical Patch Update. Administrators should apply the CPU patches associated with Oracle E-Business Suite 12.2 following Oracle's documented patch application process, including database, middle-tier, and application-tier updates as directed.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted internal networks or VPN clients can reach HRMS (France) endpoints.
Remove or scope down HRMS (France) responsibilities from users who do not require payroll access until patching is complete.
Place a web application firewall or reverse proxy in front of the E-Business Suite middle tier and log all requests to French HR Payroll URLs for review.

bash

# Example: verify applied CPU patches on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF