CVE-2026-60571 Overview
CVE-2026-60571 is a vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite, within the Installation component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle SDP Number Portability. Successful exploitation allows unauthorized update, insert, or delete access to a subset of Oracle SDP Number Portability data and can cause a partial denial of service.
Critical Impact
Authenticated network-adjacent attackers can tamper with Oracle SDP Number Portability data and degrade availability, impacting integrity and continuity of telecom number portability workflows.
Affected Products
- Oracle E-Business Suite — Oracle SDP Number Portability, version 12.2.3
- Oracle E-Business Suite — Oracle SDP Number Portability, versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle SDP Number Portability, version 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60571 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60571
Vulnerability Analysis
The flaw resides in the Installation component of Oracle SDP Number Portability, a module of Oracle E-Business Suite. An attacker holding low-privileged credentials can send crafted HTTP requests over the network to reach the affected functionality. Exploitation does not require user interaction and does not cross a security boundary, keeping the impact scoped to the Oracle SDP Number Portability component.
Successful exploitation yields limited write access to component-accessible data, allowing update, insert, or delete operations. The same code path can be abused to trigger a partial denial of service, degrading availability without fully disabling the service. Confidentiality is not impacted, but integrity and availability are.
The EPSS score is 0.3% (22.118 percentile) as of 2026-07-23, indicating a low near-term likelihood of observed exploitation activity.
Root Cause
Oracle has not publicly disclosed the underlying defect. Based on the advisory context, the Installation component fails to properly enforce authorization or validate input on a network-reachable HTTP interface. The result is that an authenticated caller can invoke privileged data-modification behavior that should not be available at their privilege level.
Attack Vector
The attack vector is network-based over HTTP against an Oracle E-Business Suite deployment exposing Oracle SDP Number Portability. The attacker must already hold valid low-privileged credentials on the target application. No user interaction is required to complete the attack.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. See the Oracle Security Alert July 2026 for vendor-supplied technical detail.
Detection Methods for CVE-2026-60571
Indicators of Compromise
- Unexpected HTTP requests to Oracle SDP Number Portability Installation endpoints originating from low-privileged accounts.
- Unauthorized INSERT, UPDATE, or DELETE operations against Oracle SDP Number Portability tables in Oracle E-Business Suite audit logs.
- Intermittent availability degradation or elevated error rates on Oracle SDP Number Portability HTTP services without corresponding infrastructure events.
Detection Strategies
- Enable Oracle E-Business Suite auditing (FND_LOGIN_AUDIT, sign-on audit level FORM) and review low-privileged user activity targeting the SDP Number Portability module.
- Correlate application server access logs with database audit trails to surface data-modification requests that bypass expected role boundaries.
- Baseline normal HTTP request patterns to the Installation component and alert on deviations, particularly repeated failed operations followed by successful writes.
Monitoring Recommendations
- Forward Oracle E-Business Suite application, web tier, and database audit logs to a centralized SIEM for cross-source correlation.
- Monitor for privilege changes or session reuse on Oracle E-Business Suite accounts that interact with the SDP Number Portability module.
- Track service-level metrics on Oracle SDP Number Portability endpoints to identify partial denial-of-service conditions early.
How to Mitigate CVE-2026-60571
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running Oracle SDP Number Portability 12.2.3 through 12.2.15.
- Inventory low-privileged accounts with access to the SDP Number Portability module and revoke unused entitlements.
- Restrict network reachability to Oracle E-Business Suite HTTP interfaces so only trusted internal segments and VPN clients can connect.
Patch Information
Oracle addressed CVE-2026-60571 in the Oracle Security Alert July 2026. Administrators should follow Oracle's Critical Patch Update advisory guidance for Oracle E-Business Suite 12.2 and apply the associated patches to all affected environments, including development, test, and disaster recovery instances.
Workarounds
- Block or tightly filter HTTP access to Oracle SDP Number Portability Installation URLs at the reverse proxy or WAF until patches are deployed.
- Rotate credentials for low-privileged Oracle E-Business Suite accounts and enforce strong password and lockout policies.
- Increase audit logging verbosity on Oracle E-Business Suite and Oracle Database tiers to shorten detection time if exploitation is attempted before patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
