CVE-2026-60732: Oracle iReceivables Auth Bypass Flaw

CVE-2026-60732 Overview

CVE-2026-60732 is a high-severity vulnerability in the Oracle iReceivables product of Oracle E-Business Suite, specifically within the AR Web Utilities component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized read, creation, deletion, and modification access to critical iReceivables data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker on the network can compromise the confidentiality and integrity of all iReceivables-accessible data over HTTP without user interaction.

Affected Products

Oracle E-Business Suite - Oracle iReceivables 12.2.3
Oracle E-Business Suite - Oracle iReceivables versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle iReceivables 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60732 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-60732

Vulnerability Analysis

The vulnerability resides in the AR Web Utilities component of Oracle iReceivables, a self-service accounts receivable module in Oracle E-Business Suite. The flaw is network exploitable over HTTP and requires only low privileges, meaning any authenticated iReceivables account can trigger it. Attack complexity is low and no user interaction is required.

Successful exploitation results in high impact to both confidentiality and integrity. An attacker can read, create, modify, or delete any data accessible to the iReceivables application. Availability is not affected, indicating the flaw enables data-layer manipulation rather than service disruption. The EPSS probability is 0.278% at the 19.9 percentile at time of publication.

Root Cause

Oracle has not publicly disclosed the underlying weakness class or CWE identifier. Based on the impact profile — data read and write access reachable by a low-privileged HTTP-authenticated user against a web utilities component — the flaw is consistent with a broken access control or authorization bypass condition in a web-facing servlet or handler.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP endpoint and a valid low-privileged iReceivables account. The attacker issues crafted HTTP requests against the AR Web Utilities component to reach data operations that should be restricted. Because the scope is unchanged and the impact is contained to iReceivables data, the vulnerability enables lateral data access within the application rather than host compromise. See the Oracle Security Alert - July 2026 for vendor guidance.

Detection Methods for CVE-2026-60732

Indicators of Compromise

Unexpected HTTP requests from low-privileged iReceivables user accounts against AR Web Utilities endpoints.
Application audit log entries showing create, update, or delete operations on receivables data by users outside their normal business scope.
Anomalous session activity for iReceivables users with elevated request volumes to internal utility URLs.

Detection Strategies

Enable and review Oracle E-Business Suite application auditing (FND_LOG_MESSAGES, sign-on audit) for iReceivables activity.
Correlate web tier access logs with iReceivables data changes to detect out-of-pattern write operations.
Baseline normal iReceivables user URL patterns and alert on deviations targeting AR Web Utilities endpoints.

Monitoring Recommendations

Forward Oracle E-Business Suite web tier and application logs to a centralized SIEM for correlation with identity telemetry.
Monitor authentication events for low-privileged iReceivables accounts accessing administrative or utility functions.
Alert on bulk read or modification patterns against receivables tables outside business hours.

How to Mitigate CVE-2026-60732

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running iReceivables versions 12.2.3 through 12.2.15.
Inventory all iReceivables-enabled environments, including non-production and DR copies, and prioritize internet-exposed instances first.
Rotate credentials for iReceivables user accounts if suspicious activity is observed in audit logs.

Patch Information

Oracle addressed CVE-2026-60732 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert - July 2026 using standard adop patching procedures for EBS 12.2.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP endpoints using firewall rules or a reverse proxy allow list until patching is complete.
Disable the iReceivables responsibility for users who do not require it to reduce the population of accounts that can reach the vulnerable component.
Enforce web application firewall rules that block anomalous request patterns against AR Web Utilities URIs.

bash

# Configuration example: apply Oracle EBS patch via adop
# Refer to the Oracle CPU July 2026 advisory for exact patch numbers
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop phase=prepare
adop phase=apply patches=<CPU_JUL2026_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup