CVE-2026-60741: Oracle Cost Management Auth Bypass Flaw

CVE-2026-60741 Overview

CVE-2026-60741 affects the Oracle Cost Management product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can compromise Oracle Cost Management without user interaction. Successful exploitation permits unauthorized read, creation, deletion, or modification of all data accessible to Oracle Cost Management. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can gain full read and write access to all data managed by Oracle Cost Management, affecting confidentiality and integrity of financial and operational records.

Affected Products

Oracle E-Business Suite — Oracle Cost Management, version 12.2.3
Oracle E-Business Suite — Oracle Cost Management, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Cost Management, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60741 published to NVD
2026-07-21 - Last updated in NVD database
Referenced in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-60741

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Cost Management, a module within Oracle E-Business Suite that tracks inventory valuation, item costs, and manufacturing cost flows. The flaw is remotely reachable over HTTP and requires only low privileges, meaning any authenticated application user can trigger the condition. No user interaction is required, and attack complexity is low.

Successful exploitation grants an attacker unauthorized access to all data accessible to Oracle Cost Management. This includes the ability to read confidential cost, pricing, and inventory data, and to create, modify, or delete records. Because Cost Management integrates with General Ledger, Inventory, and Purchasing modules, tampering can cascade into downstream financial reporting.

Root Cause

Oracle has not published root-cause details in the July 2026 Critical Patch Update advisory. The scope is unchanged, indicating the attacker operates within the security authority of the vulnerable component rather than pivoting to another. Availability is not impacted, which suggests the flaw exposes data access paths rather than a crash or resource-exhaustion condition.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates to Oracle E-Business Suite with any low-privileged application account, then submits crafted requests to the Cost Management Internal Operations endpoints. Because the exploitation path bypasses expected authorization checks, the attacker gains privileges normally reserved for cost accountants or administrators. Refer to the Oracle Security Alert - July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-60741

Indicators of Compromise

Unexpected create, update, or delete operations on CST_* cost management tables performed by non-privileged application users.
HTTP requests to Cost Management Internal Operations URLs originating from user accounts that have no historical activity in that module.
Anomalous export or bulk-read activity against item cost, cost element, or cost organization records.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record which users accessed Cost Management functions.
Correlate database audit logs (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) with Cost Management data-change events to flag privilege mismatches.
Baseline normal HTTP traffic patterns to /OA_HTML/ endpoints associated with Cost Management and alert on deviations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, concurrent manager, and database audit logs to a centralized SIEM for correlation.
Monitor for large result sets returned from Cost Management queries to users lacking a cost accounting responsibility.
Track responsibility assignment changes so that unexpected grants of Cost Management responsibilities generate alerts.

How to Mitigate CVE-2026-60741

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 instances.
Inventory user accounts with any responsibility that provides access to Cost Management and remove unnecessary assignments.
Restrict network reachability of the Oracle E-Business Suite application tier to authenticated corporate networks or VPN.

Patch Information

Oracle addressed CVE-2026-60741 in the July 2026 Critical Patch Update. Customers running Oracle E-Business Suite 12.2.3 through 12.2.15 should apply the patches referenced in the Oracle Security Alert - July 2026. Oracle recommends staying on actively supported patch levels because fixes are cumulative on the 12.2 code line.

Workarounds

No official workaround has been published by Oracle. Patching is the recommended remediation.
Reduce exposure by placing the E-Business Suite application tier behind a web application firewall and enforcing IP allow-listing for administrative access.
Review and tighten function and data security profiles on the Cost Management responsibility to enforce least privilege pending patch deployment.

bash

# Verify current Oracle E-Business Suite patch level before and after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('&JUL2026_CPU_BUG')
 ORDER BY last_update_date DESC;
EXIT;
EOF