CVE-2026-60744: Oracle Cost Management Auth Bypass Flaw

CVE-2026-60744 Overview

CVE-2026-60744 affects the Oracle Cost Management product within Oracle E-Business Suite, specifically the Internal Operations component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can compromise Oracle Cost Management, though the attack complexity is high. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Cost Management accessible data. Oracle disclosed this issue in the Oracle Security Alert July 2026.

Critical Impact
Authenticated attackers can compromise confidentiality and integrity of all Oracle Cost Management data over the network.

Affected Products

Oracle E-Business Suite - Oracle Cost Management, version 12.2.3
Oracle E-Business Suite - Oracle Cost Management, versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Cost Management, version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60744 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60744

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Cost Management, an application module within Oracle E-Business Suite (EBS) used for tracking manufacturing and inventory costs. The vulnerability is exploitable over HTTP by an authenticated actor holding low-level application privileges. No user interaction is required, and the scope remains unchanged, meaning the impact stays within the vulnerable component's security boundary.

Successful exploitation yields full read access and unauthorized write, modify, or delete operations against data accessible to Oracle Cost Management. Availability is not affected. High attack complexity indicates the attacker must satisfy conditions beyond their control, such as timing or specific configuration state, before the exploit succeeds.

The EPSS score is 0.292% with a percentile of 21.328, indicating low probability of near-term exploitation activity. No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been reported.

Root Cause

Oracle has not published the specific weakness class for CVE-2026-60744, and no CWE identifier is currently mapped. Based on the impact profile — authenticated network access producing full read/write access to component data — the flaw is consistent with an access control or input handling defect in an HTTP-facing servlet or business logic path within the Internal Operations subcomponent.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires a valid, low-privileged application account on the target Oracle E-Business Suite instance. From that account, the attacker sends crafted HTTP requests to endpoints exposed by the Internal Operations component of Oracle Cost Management. High attack complexity suggests the request sequence or environmental preconditions must align for compromise. Technical specifics have not been released. Refer to the Oracle Security Alert July 2026 for additional detail.

Detection Methods for CVE-2026-60744

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements executed against Oracle Cost Management tables by low-privileged application accounts.
Anomalous HTTP request patterns targeting Oracle Cost Management Internal Operations URLs on Oracle E-Business Suite servers.
Unauthorized data modifications in cost management records without corresponding change-management or workflow approvals.

Detection Strategies

Enable Oracle Database Fine-Grained Auditing (FGA) on tables owned by the BOM and CST schemas that back Cost Management.
Monitor Oracle E-Business Suite application-tier access logs for HTTP requests to Internal Operations servlets originating from accounts with minimal role assignments.
Correlate application session identifiers with database session activity to detect privilege mismatches.

Monitoring Recommendations

Baseline normal Cost Management transaction volumes per user and alert on statistical deviations.
Forward Oracle EBS application logs and database audit logs to a centralized SIEM for real-time correlation and retention.
Review Oracle E-Business Suite Sign-On Audit reports for logins from atypical source addresses to low-privileged accounts.

How to Mitigate CVE-2026-60744

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite deployments and confirm which host the Oracle Cost Management module.
Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted internal networks and VPN users only.
Audit low-privileged application accounts and disable those that are inactive or unnecessary.

Patch Information

Oracle addressed CVE-2026-60744 in the July 2026 Critical Patch Update. Administrators must download and apply the applicable Oracle E-Business Suite patch for versions 12.2.3 through 12.2.15 as listed in the Oracle Security Alert July 2026. Test patches in a non-production environment before rolling out to production instances.

Workarounds

Limit HTTP access to Oracle Cost Management Internal Operations URLs using a reverse proxy or web application firewall ruleset until patches are deployed.
Enforce strong password policies and multi-factor authentication for all Oracle E-Business Suite user accounts to raise the bar for low-privileged access.
Apply least-privilege review of Cost Management responsibilities and remove those not required for business function.

bash

# Configuration example: restrict access to Cost Management endpoints via reverse proxy
# Example nginx location block placed in front of Oracle E-Business Suite
location ~* /OA_HTML/.*(CST|Cost).* {
    allow 10.0.0.0/8;      # internal corporate network
    allow 192.168.10.0/24; # finance team subnet
    deny  all;
    proxy_pass http://ebs-app-tier:8000;
}