CVE-2026-60695: Oracle EAM Privilege Escalation Flaw

CVE-2026-60695 Overview

CVE-2026-60695 affects the Oracle Enterprise Asset Management product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a high-privileged attacker with network access via HTTP to compromise confidentiality and integrity of Oracle Enterprise Asset Management data. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Enterprise Asset Management accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized read, create, delete, and modify access to all data accessible through Oracle Enterprise Asset Management, though the attack requires high privileges and high complexity.

Affected Products

Oracle E-Business Suite — Oracle Enterprise Asset Management 12.2.3
Oracle E-Business Suite — Oracle Enterprise Asset Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Enterprise Asset Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60695 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60695

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Enterprise Asset Management. An authenticated attacker with high privileges can send crafted HTTP requests to the affected component to bypass intended data access controls. Successful requests result in unauthorized read, create, modify, or delete operations against data managed by Enterprise Asset Management.

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and valid high-privileged credentials. The attack complexity is rated high, meaning the attacker must satisfy specific conditions beyond authentication to trigger the flaw. No user interaction is required, and the scope is unchanged. Availability is not affected, but both confidentiality and integrity impacts are high.

Root Cause

Oracle has not publicly disclosed the underlying defect. Based on the impact profile, the issue reflects an access control or input validation gap in an Internal Operations code path that permits privileged users to reach data or operations outside their intended authorization boundary. Refer to the Oracle Critical Patch Update - July 2026 for vendor-supplied details.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates to Oracle E-Business Suite with high-privilege credentials, then issues crafted requests to the Enterprise Asset Management Internal Operations endpoints. The EPSS score is 0.304% with a percentile of 22.616, indicating a low probability of near-term opportunistic exploitation. No public proof-of-concept or exploit code is currently available.

No verified exploit code is available. Refer to the Oracle Critical Patch Update advisory for technical details on the affected code paths.

Detection Methods for CVE-2026-60695

Indicators of Compromise

Unexpected create, update, or delete operations against Enterprise Asset Management records performed by high-privileged accounts outside normal change windows.
Anomalous HTTP requests targeting Internal Operations endpoints of Oracle E-Business Suite with unusual payload structures or parameter values.
Access to Enterprise Asset Management data from accounts or workstations that do not typically interact with the module.

Detection Strategies

Enable Oracle E-Business Suite audit trail (FND: AuditTrail Activate) for Enterprise Asset Management tables to record row-level changes.
Correlate application server access logs with authentication events to identify high-privileged sessions issuing atypical HTTP request patterns.
Compare current Oracle E-Business Suite patch levels against the July 2026 Critical Patch Update baseline to identify unpatched systems.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and middleware logs into a centralized SIEM for correlation and long-term retention.
Alert on privileged account activity that deviates from established behavioral baselines, particularly bulk data modifications.
Monitor for the creation of new responsibilities or role grants that expand access to Enterprise Asset Management functions.

How to Mitigate CVE-2026-60695

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15.
Inventory high-privileged accounts with access to Oracle Enterprise Asset Management and revoke unnecessary entitlements.
Restrict network access to the Oracle E-Business Suite HTTP interface to trusted internal networks and VPN endpoints only.

Patch Information

Oracle released the fix for CVE-2026-60695 in the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update - July 2026 advisory for patch identifiers and installation prerequisites specific to their Oracle E-Business Suite 12.2 environment.

Workarounds

Limit the assignment of high-privileged Enterprise Asset Management responsibilities until the patch is applied.
Enforce multi-factor authentication for administrative and privileged Oracle E-Business Suite accounts to raise the bar for credential abuse.
Place a web application firewall in front of the Oracle E-Business Suite HTTP tier to inspect and rate-limit requests to Internal Operations endpoints.

bash

# Configuration example - verify patch level on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>');
EOF