CVE-2026-60688: Oracle Scheduler Auth Bypass Vulnerability

CVE-2026-60688 Overview

CVE-2026-60688 affects the Oracle Scheduler product within Oracle E-Business Suite, specifically the Rules UI component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this flaw without user interaction. Successful exploitation grants unauthorized update, insert, or delete access to a subset of Oracle Scheduler data. Attackers can also gain unauthorized read access to certain data and trigger a partial denial of service against Oracle Scheduler.

Critical Impact
Authenticated attackers with low privileges can compromise data integrity, disclose limited information, and degrade availability of Oracle Scheduler over the network.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Scheduler (Rules UI component)
Oracle E-Business Suite deployments exposing Scheduler HTTP endpoints

Discovery Timeline

2026-07-21 - CVE CVE-2026-60688 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60688

Vulnerability Analysis

The flaw resides in the Rules UI component of Oracle Scheduler, a job scheduling framework used across Oracle E-Business Suite. An authenticated attacker holding low-level application privileges can send crafted HTTP requests to the Rules UI to manipulate scheduler data outside their intended authorization scope.

The impact spans all three security properties. Attackers can read a subset of Scheduler-accessible data, modify or delete records through unauthorized insert and update operations, and induce partial denial of service conditions. The unchanged scope indicates that the impact is limited to the Oracle Scheduler component itself.

The EPSS probability sits at 0.272% with a percentile of 19.233, indicating low near-term exploitation likelihood based on current signals.

Root Cause

Oracle has not published detailed root cause information in the public advisory. Based on the affected component and impact profile, the weakness is consistent with a broken access control flaw in the Rules UI, where authorization checks fail to fully constrain what actions a low-privileged authenticated user can perform against Scheduler objects.

Attack Vector

Exploitation requires network access via HTTP to the Oracle E-Business Suite instance and a valid low-privileged account. No user interaction is required. The attacker sends crafted HTTP requests to the Rules UI endpoints in Oracle Scheduler to trigger the unauthorized data operations or partial denial of service. See the Oracle Security Alert for July 2026 for vendor-supplied context.

Detection Methods for CVE-2026-60688

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle Scheduler jobs, rules, or programs originating from low-privileged application accounts.
HTTP requests to Oracle Scheduler Rules UI endpoints from user sessions that do not typically interact with scheduling functionality.
Unexplained partial outages or degraded responsiveness of Oracle Scheduler services.

Detection Strategies

Enable Oracle E-Business Suite audit policies on Scheduler tables to record insert, update, and delete operations against DBMS_SCHEDULER objects.
Correlate application server access logs with database audit trails to identify Rules UI activity performed by non-administrative users.
Review web application firewall logs for anomalous parameter values and repeated requests targeting Scheduler Rules UI URLs.

Monitoring Recommendations

Baseline normal Scheduler API usage patterns per user role and alert on deviations, such as low-privileged accounts invoking rule modification endpoints.
Monitor Scheduler job runtime metrics and queue depth for signs of partial denial of service.
Forward Oracle E-Business Suite application, database, and web server logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-60688

Immediate Actions Required

Apply the Oracle Critical Patch Update for July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory user accounts with access to Oracle Scheduler and revoke privileges that are not required for business operations.
Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted networks and VPN users only.

Patch Information

Oracle addressed CVE-2026-60688 in the Critical Patch Update published on July 2026. Administrators should download and apply the relevant patch bundle referenced in the Oracle Security Alert for July 2026. Test the patch in a staging environment before production rollout to validate compatibility with customizations.

Workarounds

Limit access to the Oracle Scheduler Rules UI to a dedicated administrative role until patching is complete.
Place a web application firewall in front of Oracle E-Business Suite and block or rate-limit requests to Scheduler Rules UI paths from non-administrative source networks.
Increase audit logging on Scheduler-related database objects and review logs daily during the exposure window.

bash

# Example: restrict access to Scheduler Rules UI paths at the reverse proxy
location ~* /OA_HTML/.*Scheduler.*Rules { 
    allow 10.10.0.0/24;  # admin subnet
    deny  all;
}