CVE-2026-60740: Oracle Cash Management Auth Bypass Flaw

CVE-2026-60740 Overview

CVE-2026-60740 affects the Oracle Cash Management product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise Oracle Cash Management. Successful exploitation grants unauthorized creation, deletion, or modification of critical data and unauthorized read access to all data accessible to the application.

Oracle disclosed the vulnerability in the Oracle Security Alert July 2026.

Critical Impact
Authenticated attackers can compromise the confidentiality and integrity of all Oracle Cash Management data over the network with low attack complexity.

Affected Products

Oracle E-Business Suite — Oracle Cash Management 12.2.3 through 12.2.15
Component: Internal Operations
Attack surface: HTTP (network-accessible)

Discovery Timeline

2026-07-21 - CVE-2026-60740 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in Oracle Critical Patch Update / Security Alert (July 2026)

Technical Details for CVE-2026-60740

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Cash Management, a module of Oracle E-Business Suite used for bank account, cash flow, and reconciliation processing. Oracle classifies the flaw as easily exploitable over HTTP by an attacker holding low-level privileges. The impact profile shows high confidentiality and high integrity impact with no availability impact.

An authenticated actor can read, create, modify, or delete records accessible to Oracle Cash Management. Because Cash Management interacts with general ledger, bank statements, and reconciliation data, integrity loss in this component can propagate into downstream financial reporting workflows.

At the time of publication, no public proof-of-concept exists, the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability is low. Oracle EBS internet-facing deployments have historically drawn active exploitation attention, so defenders should not treat the low EPSS as long-term assurance.

Root Cause

Oracle has not published root-cause detail beyond the advisory. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N and the affected component indicate a server-side authorization or input-handling weakness in an HTTP-reachable Cash Management endpoint that fails to enforce sufficient access checks on operations against Cash Management objects.

Attack Vector

Exploitation requires network access to the Oracle EBS HTTP interface and a valid low-privileged application account. No user interaction is required, and the scope remains unchanged. An attacker sends crafted HTTP requests to the vulnerable Cash Management endpoint to read or alter records they should not be able to reach. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60740

Indicators of Compromise

Unexpected create, update, or delete operations on Cash Management tables (CE_* schema) performed by low-privileged application users.
HTTP requests to Cash Management servlets or OA Framework pages originating from user accounts that do not normally use the module.
Anomalous bank statement, reconciliation, or cash forecast records appearing outside of scheduled batch windows.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Cash Management responsibility.
Correlate application audit logs with database audit trails on CE_* and related bank account tables to detect privilege-inconsistent activity.
Alert on HTTP 200 responses to Cash Management URLs from sessions whose assigned responsibilities do not include Cash Management.

Monitoring Recommendations

Forward Oracle EBS application, middle-tier (Apache/OHS), and database audit logs to a centralized analytics platform for cross-tier correlation.
Baseline normal Cash Management usage per user and flag deviations in request volume, endpoints touched, or off-hours activity.
Monitor changes to FND user grants and responsibilities that would expand access to Cash Management functions.

How to Mitigate CVE-2026-60740

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert July 2026 to all Oracle E-Business Suite 12.2.3–12.2.15 environments.
Inventory internet-exposed EBS instances and prioritize them for patching first.
Rotate credentials for low-privileged application accounts if compromise is suspected and review recent Cash Management transactions for tampering.

Patch Information

Oracle addresses CVE-2026-60740 in the July 2026 Critical Patch Update. Administrators should follow the patch matrix and prerequisites published in the Oracle Security Alert July 2026 and apply the corresponding Cash Management and EBS technology stack patches for versions 12.2.3 through 12.2.15.

Workarounds

Restrict network access to the EBS HTTP tier using a reverse proxy, WAF, or VPN so only trusted sources can reach Cash Management URLs.
Reduce the number of users assigned Cash Management responsibilities and remove standing access from accounts that do not require it.
Enable database-level auditing on Cash Management schema objects until patches are deployed.

bash

# Configuration example: restrict access to Cash Management URLs at the web tier
# Apache/OHS httpd.conf snippet
<LocationMatch "/OA_HTML/.*(CE|CashManagement).*">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>