CVE-2026-60724: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60724 Overview

CVE-2026-60724 is a vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite, specifically in the Outcome-Result component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle Customer Interaction History. Successful exploitation grants unauthorized update, insert, or delete access to a subset of accessible data, as well as unauthorized read access to some data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network-based attackers can perform unauthorized read and write operations against Oracle Customer Interaction History data through the Outcome-Result component.

Affected Products

Oracle E-Business Suite — Oracle Customer Interaction History 12.2.3
Oracle E-Business Suite — Oracle Customer Interaction History versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Customer Interaction History 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60724 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60724

Vulnerability Analysis

The vulnerability resides in the Outcome-Result component of Oracle Customer Interaction History, part of Oracle E-Business Suite. Oracle classifies the flaw as easily exploitable over HTTP by an authenticated attacker holding low privileges. Exploitation does not require user interaction and does not cross a privilege boundary (scope unchanged). Impact is limited to confidentiality and integrity of a subset of Customer Interaction History data, with no availability impact reported. The EPSS score is 0.24% (15.2 percentile), indicating a low observed probability of exploitation activity at the time of publication.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-60724 in the public advisory. The Oracle Critical Patch Update — July 2026 states that the flaw exists in the Outcome-Result component and permits unauthorized create, read, update, and delete operations on some Customer Interaction History data. The affected component handles interaction outcome tracking within the customer service workflow of Oracle E-Business Suite.

Attack Vector

The attack originates over the network via HTTP against an exposed Oracle E-Business Suite instance. The attacker must hold a valid low-privileged application account. Once authenticated, the attacker sends crafted requests to the vulnerable Outcome-Result component to access or modify data belonging to other users or contexts. No user interaction is required, and attack complexity is low.

Oracle has not published proof-of-concept code, and no public exploit is available. See the Oracle Critical Patch Update advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-60724

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Customer Interaction History tables performed by low-privileged application accounts.
HTTP requests targeting the Oracle E-Business Suite Outcome-Result component endpoints from accounts that do not normally interact with customer service modules.
Authenticated sessions accessing Customer Interaction History records outside their assigned organizational scope.

Detection Strategies

Enable Oracle E-Business Suite auditing (FND_LOG_MESSAGES, page access tracking) on the Customer Interaction History module and alert on anomalous access patterns.
Correlate HTTP access logs from the Oracle HTTP Server tier with application session identity to detect low-privileged users invoking Outcome-Result operations.
Use database auditing on JTF_IH_* and related Customer Interaction History schema objects to flag write operations that bypass expected application workflows.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized SIEM for long-term correlation.
Baseline normal access volume per user role for Customer Interaction History and alert on statistically significant deviations.
Review privileged and low-privileged application account activity weekly until the July 2026 CPU patch is applied.

How to Mitigate CVE-2026-60724

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running Customer Interaction History versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite environments, including development, test, and disaster-recovery instances, to confirm patch coverage.
Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted internal networks and VPN users.
Review and reduce application role assignments so that only required users hold Customer Interaction History privileges.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update — July 2026 advisory for the specific patch identifiers, prerequisites, and installation instructions for Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Oracle does not document a supported workaround; patching is the vendor-recommended remediation path.
As a compensating control, remove Customer Interaction History responsibilities from application accounts that do not require them.
Place a web application firewall in front of the Oracle E-Business Suite HTTP tier to inspect and rate-limit requests to Customer Interaction History endpoints until patching completes.

bash

# Verify installed Oracle E-Business Suite patch level
# Run on the application tier as the applmgr user
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF