CVE-2026-60749: Oracle Assets Auth Bypass Vulnerability

CVE-2026-60749 Overview

CVE-2026-60749 affects the Oracle Assets product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw exists in supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness to compromise Oracle Assets. Successful exploitation allows unauthorized creation, deletion, or modification of critical data and unauthorized read access to all Oracle Assets accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can gain full read and write access to sensitive financial asset data managed by Oracle E-Business Suite, impacting the integrity and confidentiality of enterprise accounting records.

Affected Products

Oracle E-Business Suite — Oracle Assets 12.2.3
Oracle E-Business Suite — Oracle Assets versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Assets 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60749 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60749

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Assets, a fixed-asset management module inside Oracle E-Business Suite. An attacker holding low-privilege credentials can send crafted HTTP requests over the network without user interaction. The exploitation path does not require complex preconditions, which lowers the barrier for authenticated insiders or attackers who have obtained routine application accounts through phishing or credential reuse.

Successful exploitation compromises both confidentiality and integrity of Oracle Assets data. Attackers can read, create, modify, or delete asset records that typically drive financial reporting, depreciation schedules, and audit trails. Availability is not impacted, so exploitation may remain stealthy against uptime-focused monitoring. The EPSS probability of 0.365% (percentile 29.04) indicates limited observed exploitation attempts at the time of publication, but the low privilege requirement makes the flaw attractive for post-compromise lateral movement inside ERP environments.

Root Cause

Oracle has not published the underlying technical root cause. Based on the vector and privilege model, the defect stems from a broken access control condition [CWE-284] in the Internal Operations HTTP handlers, allowing authenticated users to perform operations beyond their assigned Oracle Assets responsibilities.

Attack Vector

The attack vector is network-based via HTTP against the Oracle E-Business Suite web tier. The attacker authenticates with any low-privilege application account, then issues requests to Internal Operations endpoints to read or alter asset records. Refer to the Oracle Security Alert July 2026 for vendor guidance.

No verified proof-of-concept code is publicly available.
Refer to the Oracle Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-60749

Indicators of Compromise

Unexpected HTTP requests to Oracle Assets Internal Operations URLs originating from low-privileged application user sessions.
Anomalous CREATE, UPDATE, or DELETE operations against FA_* schema tables (Fixed Assets) outside change windows.
Application audit log entries showing asset modifications by users whose Oracle responsibilities do not include Fixed Asset administration.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to capture user navigation to Internal Operations forms.
Correlate application-tier access logs with database auditing on Fixed Assets tables to identify privilege mismatches.
Baseline typical Oracle Assets transaction volumes per user and alert on statistical outliers.

Monitoring Recommendations

Forward Oracle E-Business Suite application, web tier, and database audit logs into a centralized SIEM for cross-source correlation.
Monitor Oracle HTTP Server access logs for repeated POSTs to Internal Operations endpoints from non-admin accounts.
Alert on modifications to depreciation, retirement, or asset transfer records outside approved workflow states.

How to Mitigate CVE-2026-60749

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running Oracle Assets 12.2.3 through 12.2.15.
Audit Oracle Assets responsibilities and revoke unnecessary access, especially for shared or generic application accounts.
Rotate credentials for any application accounts that have accessed Internal Operations since the vulnerability disclosure.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 and apply the referenced patches to each affected 12.2.x release level. Validate the patch in a non-production environment before promoting to production, and follow Oracle's post-patch steps for the Fixed Assets module.

Workarounds

Restrict network reachability of the Oracle E-Business Suite web tier to trusted corporate segments and VPN users only.
Enforce multi-factor authentication for all E-Business Suite users to raise the cost of low-privilege account abuse.
Temporarily remove non-essential Oracle Assets responsibilities from user profiles until patches are deployed.

bash

# Verify installed E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF