CVE-2026-60573: Oracle Partner Management Auth Bypass Flaw

CVE-2026-60573 Overview

CVE-2026-60573 affects the Partner Dashboard component of Oracle Partner Management, part of the Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access over HTTPS can exploit the flaw to gain unauthorized update, insert, or delete access to a subset of Oracle Partner Management data. The attacker can also read a subset of accessible data and cause a partial denial of service. Oracle published details in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can modify partner data, disclose limited information, and trigger partial service disruption against Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite — Oracle Partner Management (Partner Dashboard component)
Versions 12.2.3 through 12.2.15
Deployments exposing the Partner Dashboard over HTTPS to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60573 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-60573

Vulnerability Analysis

The flaw resides in the Partner Dashboard component of Oracle Partner Management, an Oracle E-Business Suite module used by channel and partner administrators. An authenticated attacker holding low-privileged application credentials can send crafted HTTPS requests to the dashboard. Successful exploitation yields limited write access to partner records, limited read access to related data, and the ability to degrade dashboard availability. Oracle rates the issue with confidentiality, integrity, and availability impacts each scoped as low, and describes it as easily exploitable without user interaction. The Exploit Prediction Scoring System (EPSS) currently reports a probability of 0.272% as of 2026-07-23.

Root Cause

Oracle has not released a technical root-cause writeup. Based on the advisory metadata, the Partner Dashboard performs insufficient authorization or input validation on requests submitted by authenticated partner users. This allows those users to reach data and operations beyond their intended scope within Oracle Partner Management.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite front end over HTTPS and a valid low-privileged application account. The attacker interacts with the Partner Dashboard through normal web request flows, so no user interaction from an administrator or victim is required. Because the vulnerability is scoped to Oracle Partner Management, impacts do not cross to other E-Business Suite components. Refer to the Oracle Security Alert - July 2026 for authoritative product details.

No public proof-of-concept or in-the-wild exploitation has been reported. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60573

Indicators of Compromise

Unexpected create, update, or delete operations on partner records performed by low-privileged application accounts.
Access to Partner Dashboard URLs or servlets by accounts that do not normally interact with partner administration.
Repeated HTTP 500 responses or dashboard timeouts consistent with a partial denial of service against the Partner Management module.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for Partner Management responsibilities.
Correlate database audit logs on AS_* and PV_* schema tables against the identity of the authenticated user in FND_LOGINS.
Alert on HTTPS requests to Partner Dashboard endpoints originating from IP ranges or user agents not associated with normal partner activity.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and Apache access logs to a centralized analytics platform for retention and correlation.
Baseline normal Partner Dashboard request volume per user and alert on deviations that could indicate abuse or a partial DoS attempt.
Track patch level of every E-Business Suite environment and flag any host still running 12.2.3 through 12.2.15 without the July 2026 CPU applied.

How to Mitigate CVE-2026-60573

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for E-Business Suite 12.2 to all affected environments.
Inventory Oracle Partner Management deployments and confirm the running codelevel matches the patched baseline.
Audit low-privileged partner accounts, disable dormant users, and reset credentials for any account showing anomalous Partner Dashboard activity.

Patch Information

Oracle addressed CVE-2026-60573 in the July 2026 Critical Patch Update. Administrators should follow the fix instructions and prerequisite guidance in the Oracle Security Alert - July 2026 and apply the patch to every affected 12.2.x instance, including non-production copies used for testing or reporting.

Workarounds

Restrict network reachability of the Partner Dashboard to trusted partner networks using a reverse proxy or web application firewall until the patch is applied.
Temporarily remove or narrow the Partner Management responsibility from user accounts that do not require it.
Enforce multi-factor authentication and strong password policies for all E-Business Suite users to raise the cost of acquiring the low-privileged access the attack requires.

bash

# Verify E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF