CVE-2026-60710: Oracle EDI Gateway Auth Bypass Flaw

CVE-2026-60710 Overview

CVE-2026-60710 is a high-severity vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can compromise the Oracle EDI Gateway. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle EDI Gateway accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated network attacker can read, modify, or delete all data accessible through Oracle EDI Gateway, undermining the confidentiality and integrity of enterprise EDI transactions.

Affected Products

Oracle E-Business Suite - Oracle EDI Gateway version 12.2.3
Oracle E-Business Suite - Oracle EDI Gateway versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle EDI Gateway version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60710 published to the National Vulnerability Database
2026-07-21 - Oracle published the Oracle Security Alert - July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60710

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle EDI Gateway, a subsystem of Oracle E-Business Suite that handles Electronic Data Interchange (EDI) transactions between enterprises. The flaw is remotely exploitable over HTTP and requires only a low-privileged account to succeed. No user interaction is required. Because EDI Gateway processes purchase orders, invoices, and shipping notices, unauthorized modification of that data can propagate downstream through financial and supply chain workflows.

Root Cause

Oracle has not published the underlying weakness class in the advisory metadata, and no CWE identifier is associated with this CVE. Based on the impact profile - authenticated network access producing full read and write access to component data - the defect is consistent with an access control or input validation failure in an HTTP-facing endpoint of the Internal Operations component. Consult the Oracle Security Alert - July 2026 for authoritative technical context.

Attack Vector

An attacker requires an authenticated session with any low-privileged Oracle E-Business Suite account. The attacker then issues crafted HTTP requests against the Oracle EDI Gateway component. Successful requests bypass intended authorization boundaries and reach data operations across all EDI Gateway accessible records. The attack complexity is low, and availability is not impacted, indicating the target operations return data or perform silent modifications rather than crashing the service.

No public proof-of-concept exploit code has been observed. The EPSS score is 0.278% at the 19.9 percentile, indicating a low near-term exploitation probability at time of publication.

Detection Methods for CVE-2026-60710

Indicators of Compromise

Unexpected HTTP requests to Oracle EDI Gateway URLs originating from low-privileged user sessions outside their normal role scope.
Unusual create, update, or delete operations on EDI transaction tables (ECE_* schema) performed by non-administrative accounts.
Access to EDI Gateway endpoints from source IPs that do not correspond to known trading partner integrations.
Anomalous spikes in outbound EDI data reads correlated with a single authenticated session.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record which users invoke EDI Gateway functions.
Correlate application-tier HTTP access logs with database audit records for APPS.ECE_* objects to detect unauthorized data operations.
Baseline expected EDI Gateway usage per user role and alert on deviations, particularly by accounts without EDI responsibilities.
Ingest Oracle HTTP Server and application logs into a SIEM to enable historical hunting for anomalous EDI Gateway request patterns.

Monitoring Recommendations

Monitor Oracle E-Business Suite responsibility assignments for unexpected grants that would allow low-privileged users to reach EDI Gateway URLs.
Alert on modifications to EDI trading partner configuration and translator definitions outside of change windows.
Track authentication events for shared or service accounts commonly used for EDI, since these are prime candidates for privilege abuse.

How to Mitigate CVE-2026-60710

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running EDI Gateway versions 12.2.3 through 12.2.15.
Inventory all low-privileged Oracle E-Business Suite accounts and remove any that are dormant, shared, or unnecessary.
Restrict network reachability of the Oracle E-Business Suite HTTP tier so that only authorized users and trading partner gateways can connect.
Review audit logs for the period preceding patch application to identify any anomalous EDI Gateway activity.

Patch Information

Oracle released a fix as part of the Oracle Security Alert - July 2026. Administrators should apply the corresponding Critical Patch Update patch to Oracle E-Business Suite 12.2 environments. Because Oracle only supports the latest patchset baseline, upgrade to a supported 12.2.x level prior to applying the CPU patch if the environment is on an older maintenance release.

Workarounds

If patching cannot be performed immediately, disable or restrict access to the EDI Gateway responsibility for all users who do not require it.
Place the Oracle E-Business Suite HTTP tier behind a web application firewall that enforces URL allowlisting for EDI Gateway paths.
Enforce network segmentation so that only jump hosts and integration servers can reach Oracle E-Business Suite application URLs.

bash

# Example: revoke a responsibility from a user via FNDLOAD after review
FNDLOAD apps/<password> 0 Y DOWNLOAD $FND_TOP/patch/115/import/afscursp.lct \
  user_responsibilities.ldt FND_USER_RESP_GROUPS USER_NAME="<USER>"
# Review the LDT, remove the EDI Gateway responsibility entry, then UPLOAD