CVE-2026-60572: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60572 Overview

CVE-2026-60572 is a vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product, specifically within the Web Service Provider component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise the Integrated SOA Gateway. Successful exploitation can result in unauthorized update, insert, or delete access to a subset of data, unauthorized read access to a subset of data, and partial denial of service. Oracle published the advisory in the Oracle Security Alert July 2026 release.

Critical Impact
Authenticated attackers can tamper with Integrated SOA Gateway data and cause partial service disruption over the network with low attack complexity.

Affected Products

Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15
Web Service Provider component
Oracle E-Business Suite deployments exposing SOA Gateway endpoints via HTTP

Discovery Timeline

2026-07-21 - CVE-2026-60572 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes Critical Patch Update advisory covering this issue

Technical Details for CVE-2026-60572

Vulnerability Analysis

The vulnerability resides in the Web Service Provider component of Oracle E-Business Suite Integrated SOA Gateway. The Integrated SOA Gateway exposes REST and SOAP web services that broker requests between external clients and internal E-Business Suite modules. A low-privileged authenticated user can send crafted HTTP requests that the gateway processes without adequate authorization or input handling, permitting operations beyond the user's intended scope.

The impact spans confidentiality, integrity, and availability at a low level for each. Attackers can perform unauthorized create, update, or delete operations against a subset of accessible data, read a subset of data, and induce a partial denial of service against the gateway itself.

The scope is unchanged, meaning the compromise remains within the vulnerable component. However, the Integrated SOA Gateway typically brokers requests to many E-Business Suite modules, so data manipulated through the gateway can propagate operational impact across dependent business processes.

Root Cause

Oracle has not disclosed the underlying weakness class or CWE mapping. Based on the described behavior — a low-privileged authenticated user performing unauthorized data operations through a web service endpoint — the flaw is consistent with a broken access control or missing authorization defect in the Web Service Provider. Consult the Oracle Security Alert July 2026 for definitive technical detail.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires low-level privileges, meaning a valid authenticated account is needed, but no user interaction is required. Attack complexity is low, so exploitation does not depend on race conditions or environmental prerequisites. An attacker with any low-privileged Oracle E-Business Suite account can reach the Integrated SOA Gateway endpoints and submit crafted service requests. No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60572

Indicators of Compromise

Unexpected HTTP requests to Integrated SOA Gateway endpoints such as /webservices/SOAProvider/ or /webservices/rest/ from low-privileged accounts
Anomalous create, update, or delete operations recorded in FND_LOG_MESSAGES or SOA Gateway audit tables
Web service invocations by user accounts that historically do not consume SOA Gateway services
Spikes in HTTP 5xx errors or request timeouts from the SOA Gateway indicating partial denial of service

Detection Strategies

Enable Integrated SOA Gateway logging and correlate service invocations against a baseline of expected callers and operations
Review Oracle HTTP Server access logs for POST and PUT requests to SOA Gateway paths originating from non-integration user accounts
Alert on data modification web service calls performed by accounts lacking documented integration roles

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and E-Business Suite audit logs to a centralized SIEM for correlation
Monitor Integrated SOA Gateway responsibility assignments and detect newly granted access to service administration pages
Track database changes made via SOA Gateway service accounts against change-management tickets

How to Mitigate CVE-2026-60572

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as documented in the Oracle Security Alert July 2026
Inventory all Oracle E-Business Suite 12.2.3 through 12.2.15 deployments and confirm Integrated SOA Gateway exposure
Review low-privileged account access to SOA Gateway responsibilities and revoke unnecessary assignments
Restrict network reachability of SOA Gateway endpoints to trusted integration hosts

Patch Information

Oracle addressed CVE-2026-60572 in the July 2026 Critical Patch Update. Administrators should follow the version-specific patch guidance published in the Oracle Security Alert July 2026 and apply the update to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 instances.

Workarounds

Disable Integrated SOA Gateway web services that are not required for business operations via the Integrated SOA Gateway administration console
Enforce network segmentation and firewall rules that limit HTTP access to SOA Gateway endpoints to known integration partners
Require strong authentication and rotate credentials for accounts that consume SOA Gateway services until patching is complete

bash

# Example: restrict SOA Gateway access at the reverse proxy
# Only allow trusted integration hosts to reach the SOA Gateway paths
<Location /webservices/>
    Require ip 10.10.20.0/24
    Require ip 10.10.30.15
</Location>