CVE-2026-60738 Overview
CVE-2026-60738 affects the Oracle Installed Base product within Oracle E-Business Suite, specifically the Create Item Instance component. Supported versions 12.2.3 through 12.2.15 are impacted. A low-privileged attacker with network access over HTTP can exploit this flaw to compromise Oracle Installed Base. Successful exploitation results in full takeover of the affected component, with high impact to confidentiality, integrity, and availability.
Critical Impact
Authenticated attackers can achieve complete takeover of Oracle Installed Base through network-accessible HTTP endpoints, exposing sensitive asset lifecycle data and enabling manipulation of enterprise item records.
Affected Products
- Oracle E-Business Suite — Oracle Installed Base 12.2.3
- Oracle E-Business Suite — Oracle Installed Base versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Installed Base 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60738 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in Oracle Security Alert July 2026
Technical Details for CVE-2026-60738
Vulnerability Analysis
The vulnerability resides in the Create Item Instance component of Oracle Installed Base, a module that tracks the lifecycle of customer-owned assets and product instances across the Oracle E-Business Suite. The flaw is remotely reachable over HTTP and requires only a low-privileged account, making it accessible to any authenticated user with limited application access.
Successful exploitation results in complete takeover of Oracle Installed Base. This grants an attacker the ability to read, modify, and destroy installed base records including asset ownership, contract linkage, and service history. Because Installed Base integrates with Service Contracts, Field Service, and Depot Repair modules, downstream business processes can be manipulated once the component is compromised.
Root Cause
Oracle does not publicly disclose root-cause details for issues addressed through the Critical Patch Update process. Based on the CVSS metrics, the flaw is network-reachable, has low attack complexity, requires low privileges, and needs no user interaction, indicating a server-side defect in how the Create Item Instance code path handles authenticated HTTP input.
Attack Vector
The attack vector is remote and authenticated. An attacker with a low-privileged E-Business Suite account submits crafted HTTP requests to the Installed Base Create Item Instance endpoint. No user interaction is required, and the scope remains unchanged, but the impact extends across confidentiality, integrity, and availability of the Installed Base component.
No public proof-of-concept exploit or exploit database entry has been observed. The EPSS probability for exploitation is 0.447%.
Detection Methods for CVE-2026-60738
Indicators of Compromise
- Unexpected creation or modification of item instances by low-privileged user accounts in the CSI_ITEM_INSTANCES table.
- HTTP POST requests targeting Installed Base Create Item Instance endpoints from unusual source addresses or session contexts.
- Anomalous spikes in Oracle E-Business Suite application server logs referencing the csi.* package or Installed Base servlets.
- Audit trail gaps or disabled auditing on Installed Base tables following authenticated sessions.
Detection Strategies
- Enable and review Oracle E-Business Suite Sign-On Audit and page-access tracking for the Installed Base responsibility.
- Correlate application-tier HTTP access logs with database audit records to identify low-privileged accounts invoking Installed Base APIs outside their business role.
- Alert on privilege changes, new responsibilities, or grant modifications tied to CSI (Customer Support Installed Base) schemas.
Monitoring Recommendations
- Forward Oracle HTTP Server, application, and database audit logs to a centralized analytics platform for behavioral baselining.
- Monitor for outbound connections and lateral movement originating from the E-Business Suite middle tier after suspicious Installed Base activity.
- Track patch inventory to confirm the July 2026 Critical Patch Update is applied across all Installed Base instances.
How to Mitigate CVE-2026-60738
Immediate Actions Required
- Apply the fixes delivered in the Oracle Critical Patch Update — July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
- Inventory user accounts with access to Installed Base responsibilities and revoke unnecessary low-privileged access.
- Restrict network reachability to the E-Business Suite middle tier so that only trusted corporate networks and VPN clients can access HTTP endpoints.
Patch Information
Oracle addressed CVE-2026-60738 as part of the July 2026 Critical Patch Update. Administrators should follow the patch application guidance published in the advisory and validate that the Installed Base module version reflects the fixed build after deployment. Refer to Oracle Security Alert July 2026 for patch download details.
Workarounds
- Remove the Installed Base responsibility from users who do not require Create Item Instance functionality until patching is complete.
- Place the E-Business Suite HTTP tier behind a web application firewall and block direct external access to Installed Base URLs.
- Enable database-level auditing on CSI_ITEM_INSTANCES and related tables to detect unauthorized modifications during the remediation window.
# Example: apply Oracle Critical Patch Update via adop (E-Business Suite 12.2)
source $APPL_TOP/EBSapps.env run
adop phase=prepare
adop phase=apply patches=<CPU_JUL2026_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
