CVE-2026-60491: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60491 Overview

CVE-2026-60491 is a vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite, specifically within the SDK client integration component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation allows unauthorized update, insert, or delete access to a subset of data, unauthorized read access to a subset of data, and the ability to cause partial denial of service. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can compromise data integrity, disclose limited data, and disrupt availability of Oracle Advanced Inbound Telephony through the SDK client integration over HTTP.

Affected Products

Oracle E-Business Suite - Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15
Component: SDK client integration
Deployment scope: Internet-facing or intranet HTTP-accessible EBS instances

Discovery Timeline

2026-07-21 - CVE CVE-2026-60491 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the July 2026 Critical Patch Update

Technical Details for CVE-2026-60491

Vulnerability Analysis

The vulnerability resides in the SDK client integration component of Oracle Advanced Inbound Telephony, part of the wider Oracle E-Business Suite. Oracle describes the flaw as easily exploitable over the network via HTTP. Exploitation requires low-level authentication but no user interaction, and the scope remains unchanged. The impact spans all three CIA properties at a low level, resulting in partial data modification, partial data disclosure, and partial denial of service of the telephony service. Because Advanced Inbound Telephony frequently integrates with call routing, CRM, and interactive voice response (IVR) workflows, disruption or tampering can cascade into customer-facing operations. The EPSS score is 0.272% with a percentile of 19.233, indicating a relatively low but non-zero probability of near-term exploitation activity.

Root Cause

Oracle has not published a detailed root cause in the public advisory. The vulnerable surface is the SDK client integration in Advanced Inbound Telephony, which handles requests from client-side telephony SDK components. The attack profile is consistent with an input handling or access control weakness reachable via authenticated HTTP requests to EBS endpoints exposed by the module.

Attack Vector

An attacker requires network reachability to the EBS HTTP interface and a valid low-privilege application account. The attacker submits crafted HTTP requests to endpoints served by the SDK client integration component. Successful requests can alter, insert, or delete a subset of records handled by Advanced Inbound Telephony, read a subset of records, or trigger conditions that partially degrade service. See the Oracle Critical Patch Update July 2026 for authoritative product and patch details.

Detection Methods for CVE-2026-60491

Indicators of Compromise

Unexpected HTTP requests from low-privileged EBS accounts targeting Advanced Inbound Telephony SDK integration endpoints
Anomalous INSERT, UPDATE, or DELETE operations on Advanced Inbound Telephony tables outside normal business hours
Repeated partial service disruptions or timeouts in the inbound telephony workflow without corresponding infrastructure issues

Detection Strategies

Enable and review EBS application audit trails for the Advanced Inbound Telephony module, focusing on data-modifying actions by non-administrative accounts
Correlate web application server access logs with database change logs to identify write activity originating from anomalous session identifiers
Baseline normal SDK client integration traffic and alert on volume, method, or parameter deviations

Monitoring Recommendations

Forward EBS mid-tier logs, Apache/OHS access logs, and database audit logs into a centralized analytics platform for cross-source correlation
Monitor authentication events for low-privileged EBS accounts showing unusual API activity against telephony endpoints
Track availability metrics for the Advanced Inbound Telephony service to detect partial DoS conditions early

How to Mitigate CVE-2026-60491

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Advanced Inbound Telephony versions 12.2.3 through 12.2.15
Inventory EBS instances to confirm whether the Advanced Inbound Telephony module is licensed and enabled, and prioritize patching where it is
Review and reduce the population of low-privileged accounts with access to telephony endpoints

Patch Information

Oracle addressed CVE-2026-60491 in the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented CPU application process for EBS 12.2, including pre-checks, mid-tier and database patching, and post-installation verification of the Advanced Inbound Telephony module.

Workarounds

Restrict network access to EBS HTTP endpoints using perimeter controls and internal segmentation, limiting exposure to trusted client networks
Disable the Advanced Inbound Telephony module in environments where it is not actively used until the CPU is applied
Enforce strong session controls and monitor authenticated HTTP requests to the SDK client integration component

bash

# Example: verify installed EBS patch level and confirm July 2026 CPU application
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<JUL2026_CPU_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF