CVE-2026-60684: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60684 Overview

CVE-2026-60684 is a vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite, specifically in the Upload Attachments functionality. Affected versions include 12.2.8 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue, though successful exploitation requires human interaction from a user other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to a subset of data, along with unauthorized read access to some Oracle Applications Framework data. Oracle addressed the issue in the Oracle Security Alert July 2026.

Critical Impact
Low-privileged authenticated attackers can achieve unauthorized read, insert, update, or delete access to Oracle Applications Framework data through the Upload Attachments component when a legitimate user interacts with attacker-supplied content.

Affected Products

Oracle E-Business Suite - Oracle Applications Framework 12.2.8
Oracle E-Business Suite - Oracle Applications Framework versions 12.2.9 through 12.2.14
Oracle E-Business Suite - Oracle Applications Framework 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60684 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Critical Patch Update / Security Alert

Technical Details for CVE-2026-60684

Vulnerability Analysis

The vulnerability resides in the Upload Attachments component of Oracle Applications Framework, a core UI and services layer used across Oracle E-Business Suite modules. An authenticated attacker with low privileges can send crafted HTTP requests that abuse the attachment upload workflow. Exploitation is described as easily achievable but requires interaction from a second user, which suggests attacker-supplied content triggers the impact when opened, rendered, or processed by a victim. Impacts are limited in scope: partial confidentiality loss and partial integrity loss, with no availability impact reported. The EPSS probability of exploitation is 0.213%.

Root Cause

Oracle has not published root-cause details beyond the advisory. Based on the component (Upload Attachments) and the impact profile (unauthorized read plus unauthorized insert, update, or delete of a subset of data), the issue is consistent with improper validation or authorization within the attachment handling workflow of Oracle Applications Framework.

Attack Vector

The attack is delivered over the network via HTTP against an Oracle E-Business Suite instance. The attacker must authenticate with low privileges and must induce a separate user to interact with the attacker-supplied content or request. No availability impact is reported, and scope is unchanged, meaning the impact remains within the vulnerable component's security authority.

No verified exploit code is publicly available for CVE-2026-60684. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60684

Indicators of Compromise

Unexpected file uploads submitted through Oracle Applications Framework attachment endpoints by low-privileged user accounts.
Attachment records containing unusual MIME types, script content, or unexpected metadata associated with Oracle E-Business Suite modules.
Access log entries showing HTTP requests to OA.jsp or fndAttachedDocuments endpoints followed by activity from a different user session shortly after.

Detection Strategies

Review Oracle E-Business Suite audit tables (FND_LOGINS, FND_ATTACHED_DOCUMENTS) for anomalous upload activity tied to low-privileged accounts.
Correlate web tier access logs with database changes to identify sequences where an upload precedes unexpected data modifications by another user.
Baseline expected attachment file types and sizes per module, then alert on deviations.

Monitoring Recommendations

Enable and forward Oracle E-Business Suite application, Apache, and Weblogic access logs to a centralized analytics platform for retention and correlation.
Monitor for spikes in attachment uploads followed by cross-user interactions within a short time window.
Track privileged administrator or approver accounts opening attachments uploaded by low-privileged users.

How to Mitigate CVE-2026-60684

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as documented in the Oracle Security Alert July 2026.
Inventory all Oracle E-Business Suite environments running Oracle Applications Framework versions 12.2.8 through 12.2.15 and prioritize internet-facing instances.
Audit accounts with access to attachment upload functionality and remove unnecessary privileges.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update cycle. Administrators should apply the patches referenced in the Oracle Security Alert July 2026 to all affected 12.2.8–12.2.15 deployments. Follow Oracle's standard EBS patch application procedure, including adop prepare, apply, finalize, cutover, and cleanup phases.

Workarounds

Restrict access to the Upload Attachments functionality to only the roles and responsibilities that require it.
Place Oracle E-Business Suite behind a reverse proxy or web application firewall configured to inspect and constrain attachment uploads by size, MIME type, and content.
Train users with elevated privileges to avoid opening unexpected attachments submitted by lower-privileged users until patches are applied.

bash

# Configuration example - verify Applications Framework version before patching
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number IN ('<July2026-CPU-bug-id>');
EOF