CVE-2026-60697 Overview
CVE-2026-60697 is a vulnerability in the Oracle Site Hub product of Oracle E-Business Suite, specifically within the Site Hierarchy Flows component. Affected releases include supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw against Oracle Site Hub. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of Site Hub data, unauthorized read access to a subset of Site Hub data, and a partial denial of service condition. Oracle disclosed the issue as part of the July 2026 Critical Patch Update.
Critical Impact
Authenticated network attackers can modify or read a subset of Oracle Site Hub data and trigger a partial denial of service through the Site Hierarchy Flows component.
Affected Products
- Oracle E-Business Suite - Oracle Site Hub, version 12.2.3
- Oracle E-Business Suite - Oracle Site Hub, versions 12.2.4 through 12.2.14
- Oracle E-Business Suite - Oracle Site Hub, version 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60697 published to the National Vulnerability Database
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle addresses the vulnerability in the Critical Patch Update advisory
Technical Details for CVE-2026-60697
Vulnerability Analysis
The vulnerability resides in the Site Hierarchy Flows component of Oracle Site Hub, an Oracle E-Business Suite module used to centrally manage site information across enterprise applications. The flaw allows an authenticated attacker holding low privileges to abuse HTTP-exposed flows to read, modify, or remove records the account should not otherwise access. Impact is scoped to a subset of Site Hub data rather than the entire application, and the denial of service condition is partial, meaning service degradation rather than full outage.
Because exploitation requires only a valid low-privileged account and no user interaction, any user with authenticated access to the E-Business Suite front end represents a potential threat vector. In multi-tenant deployments and large ERP environments where many operators hold basic Site Hub roles, the exposure surface is broad. Oracle categorizes the issue under confidentiality, integrity, and availability impacts, indicating the flaw affects all three security properties at a limited scope.
Root Cause
Oracle has not published the underlying [CWE] classification. Based on the advisory description, the vulnerability stems from insufficient authorization enforcement within the Site Hierarchy Flows HTTP handlers, allowing a low-privileged session to perform data operations beyond its intended access boundary.
Attack Vector
The attack vector is network-based over HTTP. An attacker authenticates to Oracle E-Business Suite with a low-privileged account and submits crafted requests against the Site Hierarchy Flows endpoints of Oracle Site Hub. No user interaction is required, and attack complexity is low. The scope remains unchanged, so exploitation does not cross a security authority boundary.
No verified public proof-of-concept code is available. Refer to the Oracle Critical Patch Update advisory for vendor-provided technical detail and patch metadata.
Detection Methods for CVE-2026-60697
Indicators of Compromise
- Unexpected create, update, or delete operations against Site Hub hierarchy tables originating from low-privileged application accounts.
- Anomalous HTTP request volume or error rates targeting Site Hierarchy Flows URLs within the E-Business Suite web tier.
- Authenticated sessions performing Site Hub actions outside their normal responsibility set or working hours.
Detection Strategies
- Enable and review Oracle E-Business Suite audit trails for Site Hub tables to identify unauthorized data changes.
- Correlate web server access logs with application user identity to flag low-privileged accounts invoking Site Hierarchy Flows endpoints.
- Baseline normal Site Hub API call patterns and alert on deviations in request volume, parameters, or response codes.
Monitoring Recommendations
- Forward E-Business Suite application logs, HTTP access logs, and database audit logs to a centralized analytics platform for correlation.
- Track failed and successful authorization decisions within Oracle Site Hub to detect repeated boundary probing.
- Monitor for partial availability degradation of Site Hub services, including elevated response latency or intermittent 5xx errors.
How to Mitigate CVE-2026-60697
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite Site Hub as soon as change windows allow.
- Inventory all E-Business Suite deployments running versions 12.2.3 through 12.2.15 and prioritize internet-exposed instances.
- Review and tighten Oracle Site Hub role assignments to remove unnecessary low-privilege access for users who do not require Site Hierarchy functionality.
Patch Information
Oracle addressed CVE-2026-60697 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update advisory for the specific patch identifiers applicable to their E-Business Suite release and apply them following Oracle's documented upgrade procedures.
Workarounds
- Restrict network access to the E-Business Suite web tier using firewall rules, VPN gating, or reverse proxy allow-lists until patches are deployed.
- Disable or restrict the Site Hierarchy Flows responsibilities for accounts that do not require them.
- Increase audit logging granularity on Site Hub objects to detect exploitation attempts while remediation is pending.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
