CVE-2026-60755: Oracle Assets Privilege Escalation Flaw

CVE-2026-60755 Overview

CVE-2026-60755 is a high-severity vulnerability in the Oracle Assets product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows an authenticated attacker with high privileges and network access via HTTP to compromise Oracle Assets. Successful exploitation results in complete takeover of the Oracle Assets module, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
An authenticated attacker with high privileges can take over Oracle Assets remotely over HTTP, compromising financial asset data and business operations.

Affected Products

Oracle E-Business Suite - Oracle Assets 12.2.3
Oracle E-Business Suite - Oracle Assets versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Assets 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60755 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes advisory in Critical Patch Update (Oracle Security Alert July 2026)

Technical Details for CVE-2026-60755

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Assets, part of the Oracle E-Business Suite financial application stack. Oracle rates the flaw as easily exploitable, meaning no unusual conditions or complex preconditions are required. The attacker must already hold high privileges within the application, but network reachability over HTTP is the only transport requirement.

Successful exploitation grants the attacker full takeover of Oracle Assets. This means the attacker can read, modify, and destroy fixed asset records, depreciation schedules, and related financial data. Because Oracle Assets integrates with the General Ledger and other E-Business Suite modules, downstream financial reporting integrity is also at risk.

Oracle did not publish a Common Weakness Enumeration (CWE) classification for this issue. The EPSS score is 0.342% at the 26.66 percentile, indicating a low predicted probability of near-term exploitation.

Root Cause

Oracle has not published root-cause details in the public advisory. The scope remains unchanged in the CVSS vector, indicating the impact stays within the vulnerable component. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context available under support agreements.

Attack Vector

The attack path requires HTTP network access to a reachable Oracle E-Business Suite instance running an affected Oracle Assets version. The attacker must authenticate with a high-privilege account before invoking the vulnerable functionality in the Internal Operations component. No user interaction is required. Compromise of a privileged Oracle E-Business Suite account through phishing, credential reuse, or session hijacking is a plausible precursor step.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60755

Indicators of Compromise

Unexpected modifications to fixed asset records, categories, or depreciation books performed by privileged accounts outside normal business hours.
Anomalous HTTP requests to Oracle Assets Internal Operations endpoints from unusual source IP addresses or user agents.
New or modified Oracle E-Business Suite responsibilities granting elevated access to Oracle Assets shortly before suspicious activity.

Detection Strategies

Review Oracle E-Business Suite FND_LOGIN_RESPONSIBILITIES and audit tables (FND_LOGINS, FND_UNSUCCESSFUL_LOGINS) for privileged session anomalies.
Enable Oracle Assets sub-ledger auditing to capture create, update, and delete operations on asset records.
Correlate application-layer logs with web server access logs to identify unauthorized HTTP requests targeting Oracle Assets URLs.

Monitoring Recommendations

Forward Oracle E-Business Suite audit logs, apache access logs, and database audit trails to a centralized SIEM for behavioral analysis.
Alert on privilege escalations that assign Oracle Assets super-user responsibilities to existing accounts.
Baseline normal transaction volumes for Oracle Assets and alert on statistical deviations that may indicate mass modification.

How to Mitigate CVE-2026-60755

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as documented in the Oracle Security Alert July 2026.
Inventory all Oracle E-Business Suite instances and confirm which run Oracle Assets versions 12.2.3 through 12.2.15.
Rotate credentials for all high-privileged Oracle Assets and system administrator accounts.
Restrict network access to Oracle E-Business Suite management interfaces to trusted administrative networks.

Patch Information

Oracle addressed CVE-2026-60755 in the July 2026 Critical Patch Update. Administrators should download the applicable patch for Oracle E-Business Suite versions 12.2.3 through 12.2.15 from My Oracle Support and follow standard EBS patching procedures, including AutoConfig runs and post-patch validation. Refer to the Oracle Security Alert July 2026 for exact patch identifiers and prerequisites.

Workarounds

Limit assignment of high-privilege Oracle Assets responsibilities to a minimal set of named users pending patch deployment.
Enforce multi-factor authentication for all privileged Oracle E-Business Suite accounts to reduce the likelihood of account takeover.
Place Oracle E-Business Suite behind a web application firewall configured to restrict access to Oracle Assets URLs by source IP and session context.

bash

# Configuration example: restrict Oracle Assets URL access at the web tier
# Example Apache/OHS configuration snippet - adapt paths to your environment
<Location /OA_HTML/oaassets>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>