CVE-2026-60588: Oracle EAM Authentication Bypass Flaw

CVE-2026-60588 Overview

CVE-2026-60588 is a vulnerability in the Oracle Enterprise Asset Management (eAM) product within Oracle E-Business Suite, affecting the Work Definition Issues component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access over HTTPS to compromise Oracle Enterprise Asset Management. Successful exploitation can lead to unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some accessible data.

Critical Impact
An authenticated network attacker can read, modify, insert, or delete a subset of Oracle Enterprise Asset Management data, undermining the integrity and confidentiality of enterprise asset records.

Affected Products

Oracle E-Business Suite — Oracle Enterprise Asset Management 12.2.3
Oracle E-Business Suite — Oracle Enterprise Asset Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Enterprise Asset Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60588 published to NVD
2026-07-21 - Last updated in NVD database
Vendor advisory: Oracle Security Advisory July 2026

Technical Details for CVE-2026-60588

Vulnerability Analysis

The vulnerability resides in the Work Definition Issues component of Oracle Enterprise Asset Management, part of Oracle E-Business Suite. An attacker who already holds low-privilege credentials in the application can reach the vulnerable functionality over HTTPS. Exploitation does not require user interaction and is described by Oracle as easily exploitable.

Successful attacks impact both confidentiality and integrity. The attacker gains unauthorized read access to a subset of Enterprise Asset Management data and can perform unauthorized update, insert, or delete operations on some records. Availability is not affected, and the scope remains unchanged, so impact is confined to the Oracle Enterprise Asset Management component. The EPSS probability is 0.24%.

Root Cause

Oracle has not published a technical root-cause analysis. The advisory identifies the affected component as Work Definition Issues within Oracle Enterprise Asset Management. The privilege and access requirements indicate an authorization or input validation weakness reachable through an authenticated HTTPS session that permits both read and write operations beyond the caller's intended entitlements.

Attack Vector

The attack vector is network-based over HTTPS. An attacker requires low-level authenticated access to the Oracle E-Business Suite environment. No user interaction is required to complete the attack. Once authenticated, the attacker interacts with the Work Definition Issues functionality to read or manipulate accessible Enterprise Asset Management data.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at the time of publication. Technical details beyond the Oracle advisory have not been released. Refer to the Oracle Security Advisory July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60588

Indicators of Compromise

Unexpected create, update, or delete operations against Enterprise Asset Management Work Definition records by low-privileged user accounts.
Anomalous HTTPS requests to Oracle E-Business Suite endpoints associated with the eAM Work Definition Issues module.
Read access to Enterprise Asset Management data from user roles that do not normally query those tables.

Detection Strategies

Review Oracle E-Business Suite application audit trails (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for unusual activity in eAM Work Definition forms.
Enable and inspect database-level auditing on Enterprise Asset Management tables to identify DML operations initiated from unexpected sessions or responsibilities.
Correlate authentication events with sensitive eAM transactions to detect low-privilege accounts touching Work Definition data.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database logs to a centralized analytics platform for cross-source correlation.
Baseline normal Work Definition Issues activity by user role and alert on statistical deviations in access volume or record modification rates.
Monitor administrative and functional changes to eAM responsibilities and menu entries that could expand attack surface.

How to Mitigate CVE-2026-60588

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite deployments running eAM versions 12.2.3 through 12.2.15.
Inventory user accounts with access to Oracle Enterprise Asset Management and remove entitlements that are not required for job function.
Rotate credentials for any low-privileged accounts suspected of misuse and audit their recent activity in the eAM module.

Patch Information

Oracle addressed CVE-2026-60588 in the July 2026 Critical Patch Update. Administrators should install the corresponding eAM patches for their E-Business Suite 12.2 release level. Full patch identifiers, prerequisites, and installation instructions are documented in the Oracle Security Advisory July 2026.

Workarounds

Restrict network reachability to Oracle E-Business Suite HTTPS endpoints so only trusted internal networks and authenticated VPN sessions can access the application tier.
Tighten responsibilities and function security so only required users hold access to eAM Work Definition Issues forms.
Enable enhanced auditing on Enterprise Asset Management tables and responsibilities until the July 2026 CPU is applied.

bash

# Configuration example: apply Oracle E-Business Suite July 2026 CPU
# Refer to the Oracle advisory for the exact patch numbers for your release.
# 1. Download the July 2026 CPU patches from My Oracle Support.
# 2. Source the environment.
. $APPL_TOP/APPS<CONTEXT_NAME>.env

# 3. Enable maintenance mode.
adadmin

# 4. Apply the patch with adop (12.2 online patching).
adop phase=prepare
adop phase=apply patches=<JUL2026_CPU_PATCH_NUMBER> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup

# 5. Verify patch application.
sqlplus apps/<pwd> @$AD_TOP/sql/adpatch_report.sql