CVE-2026-60717: Oracle E-Business Suite SQLi Vulnerability

CVE-2026-60717 Overview

CVE-2026-60717 is a vulnerability in the Oracle Complex Maintenance, Repair and Overhaul (cMRO) product of Oracle E-Business Suite, specifically within the Common Utilities component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful exploitation permits unauthorized update, insert, or delete access to a subset of accessible data, along with unauthorized read access to a subset of data. Oracle disclosed the issue as part of the Oracle Critical Patch Update July 2026.

Critical Impact
Authenticated attackers can tamper with and read Oracle cMRO data over the network without user interaction, impacting confidentiality and integrity of maintenance-critical business records.

Affected Products

Oracle E-Business Suite - Oracle Complex Maintenance, Repair and Overhaul, versions 12.2.3 through 12.2.15
Component: Common Utilities
Deployments exposing Oracle cMRO HTTP interfaces to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60717 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Fix included in Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60717

Vulnerability Analysis

The vulnerability resides in the Common Utilities component of Oracle Complex Maintenance, Repair and Overhaul, part of the Oracle E-Business Suite family. An authenticated attacker with low privileges can send crafted HTTP requests to the application. Successful requests result in partial data tampering and partial data disclosure within the cMRO module. Oracle rates the confidentiality and integrity impact as low, with no impact to availability. Because Oracle cMRO manages maintenance records for high-value assets such as aircraft fleets and industrial equipment, unauthorized modification of records has downstream operational and compliance consequences. The EPSS score at publication is 0.24%, placing the vulnerability in the 15th percentile for exploitation likelihood.

Root Cause

Oracle has not published the underlying weakness class, and no CWE identifier is assigned. Based on the impact profile - unauthorized read plus unauthorized update, insert, or delete within a single component reachable via HTTP by an authenticated low-privilege user - the flaw is consistent with a broken access control or missing authorization defect in the Common Utilities component. Further technical detail is restricted to Oracle customers through the Oracle Critical Patch Update July 2026.

Attack Vector

An attacker must hold valid, low-privilege credentials for the Oracle E-Business Suite instance. The attacker sends HTTP requests to the cMRO Common Utilities endpoints. No user interaction is required, and attack complexity is low. Exploitation does not cross a security boundary (scope unchanged) and does not affect availability. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit is available at the time of publication.

No verified code examples are available. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-60717

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Oracle cMRO tables performed by low-privilege application accounts
HTTP requests to Common Utilities endpoints originating from user sessions that do not typically access maintenance records
Discrepancies between cMRO audit trails and downstream ERP or maintenance reporting data

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for cMRO modules
Correlate database audit logs with HTTP access logs on the Oracle E-Business Suite middle tier to identify anomalous data modification sequences
Baseline normal cMRO usage per user role and alert on deviations, particularly write operations from read-only personas

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and HTTP server logs to a centralized SIEM for correlation
Monitor for repeated 4xx and 5xx responses from cMRO URLs, which may indicate probing
Track privileged use of Common Utilities APIs and generate alerts on off-hours activity

How to Mitigate CVE-2026-60717

Immediate Actions Required

Apply the Oracle Critical Patch Update July 2026 to all Oracle E-Business Suite instances running cMRO versions 12.2.3 through 12.2.15
Inventory user accounts with access to Oracle cMRO and remove entitlements that are not required for job function
Restrict network reachability of Oracle E-Business Suite HTTP endpoints to trusted corporate networks and VPN users

Patch Information

Oracle addressed CVE-2026-60717 in the Oracle Critical Patch Update July 2026. Customers running affected versions 12.2.3 through 12.2.15 must apply the corresponding cMRO patches referenced in the advisory. Oracle recommends remaining on actively supported versions and applying Critical Patch Updates without delay.

Workarounds

No official workaround has been published by Oracle; patching is the required remediation
As a compensating control, place a web application firewall in front of Oracle E-Business Suite to restrict access to cMRO Common Utilities URLs
Enforce least privilege on Oracle E-Business Suite responsibilities so that only authorized users can reach cMRO functions

bash

# Verify installed Oracle E-Business Suite patch level after applying CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF