CVE-2026-60685: Oracle iSupport Auth Bypass Vulnerability

CVE-2026-60685 Overview

CVE-2026-60685 is a vulnerability in the Oracle iSupport product of Oracle E-Business Suite, within the Internal Operations component. Affected releases are supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful attacks require interaction from a user other than the attacker. The vulnerability produces a scope change, meaning exploitation can affect additional products beyond Oracle iSupport. Successful attacks can result in unauthorized update, insert, or delete access to a subset of Oracle iSupport data, as well as unauthorized read access to a subset of that data.

Critical Impact
Unauthenticated network attackers can trick an authenticated user into triggering actions that modify and read Oracle iSupport data, with cross-product impact due to scope change.

Affected Products

Oracle E-Business Suite — Oracle iSupport 12.2.3
Oracle E-Business Suite — Oracle iSupport versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle iSupport 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60685 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60685

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle iSupport, a customer self-service portal within Oracle E-Business Suite. Exploitation requires an attacker to deliver a crafted HTTP request or link to a legitimate user who then interacts with it. Because the vulnerability produces a scope change, code or data actions triggered inside Oracle iSupport can influence other Oracle E-Business Suite components sharing the same security authority. The confidentiality and integrity impacts are limited but not negligible: attackers gain partial read access and can perform unauthorized insert, update, or delete operations against a subset of iSupport-accessible data. Availability is not impacted.

Root Cause

Oracle has not published a detailed root-cause writeup. The attack profile — unauthenticated network exploitation combined with mandatory user interaction and a scope change — is consistent with a client-side injection or forged-request class of weakness in the iSupport Internal Operations component. Insufficient validation of user-supplied input rendered in an authenticated session context is the most likely underlying defect.

Attack Vector

The attack vector is network-based over HTTP. An attacker crafts a malicious URL or web resource and lures an authenticated Oracle iSupport user into loading it. When the victim interacts with the resource, the attacker's payload executes in the victim's session, causing unauthorized data reads and writes within iSupport and, due to scope change, effects that reach beyond the vulnerable component. No attacker credentials are required.

No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60685

Indicators of Compromise

Inbound HTTP requests to Oracle iSupport Internal Operations endpoints containing suspicious query parameters, encoded script fragments, or unusual Referer values from external domains.
Authenticated iSupport sessions performing unexpected insert, update, or delete operations shortly after a user clicks an external link or opens an emailed URL.
Web server or WAF logs showing repeated iSupport requests originating from unauthenticated sources followed by activity within a legitimate user session.

Detection Strategies

Baseline normal Oracle iSupport request patterns and alert on deviations in parameter length, encoding, or unusual HTTP verbs against Internal Operations URLs.
Correlate email or web-proxy telemetry showing users clicking external links immediately before anomalous iSupport data modifications.
Review Oracle E-Business Suite audit tables (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES, application-specific audit logs) for data changes lacking a corresponding legitimate business action.

Monitoring Recommendations

Enable verbose HTTP access logging on the Oracle HTTP Server tier fronting E-Business Suite and forward logs to a centralized analytics platform.
Monitor for spikes in 3xx/4xx responses on iSupport Internal Operations paths, which can indicate probing.
Track cross-module writes in E-Business Suite that originate from an iSupport session, given the scope-change nature of this vulnerability.

How to Mitigate CVE-2026-60685

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update / Security Alert July 2026 to all Oracle E-Business Suite environments running iSupport versions 12.2.3 through 12.2.15.
Inventory internet-exposed Oracle iSupport instances and prioritize patching of externally reachable systems first.
Notify iSupport users to avoid clicking untrusted links that reference Oracle E-Business Suite hostnames or parameters.

Patch Information

Oracle published fixes for this vulnerability in the July 2026 Critical Patch Update. Administrators should download and apply the corresponding patch for their exact Oracle E-Business Suite 12.2.x release as documented in the Oracle Security Alert July 2026.

Workarounds

Restrict access to Oracle iSupport Internal Operations endpoints using a web application firewall or reverse proxy allow-list until patches are applied.
Enforce strict Referer and Origin header checks at the perimeter for iSupport requests to reduce cross-site attack success.
Shorten iSupport session lifetimes and require re-authentication for sensitive Internal Operations actions to limit the window of exploitation.

bash

# Example: block external referers to iSupport Internal Operations at an Apache/OHS reverse proxy
<Location /OA_HTML/>
    SetEnvIfNoCase Referer "^https?://(www\.)?example\.com/" allowed_ref
    Require env allowed_ref
</Location>