CVE-2026-60770: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60770 Overview

CVE-2026-60770 is a high-severity vulnerability in the Oracle Application Object Library (AOL) component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness to compromise the Oracle Application Object Library. Successful exploitation results in full takeover of the AOL component, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in its July 2026 Critical Patch Update advisory. Exploitation requires authenticated network access and is rated as high attack complexity.

Critical Impact
Successful exploitation allows a low-privileged remote attacker to fully take over the Oracle Application Object Library, compromising confidentiality, integrity, and availability of Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite — Oracle Application Object Library 12.2.3
Oracle E-Business Suite — Oracle Application Object Library versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Application Object Library 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60770 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle issued the Oracle Security Alert July 2026 addressing this vulnerability

Technical Details for CVE-2026-60770

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Application Object Library, the foundational framework that provides shared services such as authentication, session handling, concurrent processing, and menu navigation across Oracle E-Business Suite modules. An authenticated attacker with low privileges can send crafted HTTP requests to the AOL layer and gain control over the library. Because AOL underpins most E-Business Suite modules, takeover of this component extends impact to downstream financial, HR, and procurement functionality. The Oracle advisory characterizes the attack complexity as high, indicating that exploitation depends on specific runtime conditions that the attacker must satisfy.

Root Cause

Oracle has not published the underlying weakness class, and no CWE identifier is assigned in the NVD record. The advisory scope confines the defect to the Core subcomponent of the Application Object Library, suggesting the flaw exists in a shared service path used across E-Business Suite modules. Consult the Oracle Security Alert July 2026 for vendor-authoritative details.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold valid low-privileged credentials to the E-Business Suite instance. No user interaction is required. The vulnerability affects only the vulnerable component and does not change scope. The EPSS score of 0.345% (26.9 percentile) reflects a low predicted probability of near-term exploitation, though this metric does not eliminate risk for internet-exposed E-Business Suite environments.

No verified public proof-of-concept code is available. See the vendor advisory for technical remediation guidance.

Detection Methods for CVE-2026-60770

Indicators of Compromise

Unexpected HTTP requests to Oracle Application Object Library endpoints from low-privileged user sessions, particularly to /OA_HTML/ paths.
Anomalous session activity in FND_LOGIN_RESPONSIBILITIES and related AOL audit tables, including privilege changes not tied to administrator actions.
Concurrent manager job submissions or profile option changes originating from accounts without corresponding administrative responsibilities.

Detection Strategies

Correlate Oracle HTTP Server access logs with FND audit tables to identify low-privileged accounts issuing requests that touch AOL Core services.
Baseline normal request patterns per responsibility, then flag deviations such as unusual POST bodies or repeated malformed requests to AOL endpoints.
Enable Oracle E-Business Suite Sign-On Audit and Function Security auditing to record authentication and function invocation events.

Monitoring Recommendations

Forward Oracle HTTP Server, database audit, and FND audit logs to a centralized SIEM for correlation and long-term retention.
Monitor for lateral movement from the E-Business Suite application tier to database and middle-tier hosts.
Alert on modifications to FND_USER, FND_RESPONSIBILITY, and profile option tables that occur outside change windows.

How to Mitigate CVE-2026-60770

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.3 through 12.2.15.
Inventory all E-Business Suite environments, including development, test, and disaster recovery, to ensure no unpatched instances remain reachable.
Restrict network access to E-Business Suite HTTP endpoints so that only trusted networks and VPN users can reach the application tier.
Rotate credentials for privileged and service accounts if compromise is suspected.

Patch Information

Oracle addresses this vulnerability in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding patch set for their Oracle E-Business Suite 12.2.x release level. Post-patch verification should include running adop phase status checks and confirming AOL patch levels via FND_PRODUCT_INSTALLATIONS.

Workarounds

Place the E-Business Suite application tier behind a web application firewall configured to inspect and filter HTTP requests to AOL endpoints.
Enforce least-privilege responsibility assignments so that user accounts cannot access AOL functions outside their business role.
Disable unused E-Business Suite modules and responsibilities to reduce the exposed HTTP surface until patching completes.

bash

# Verify Oracle E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY creation_date DESC;
EOF

# Confirm AOL (FND) product installation status
sqlplus apps/<password> <<EOF
SELECT application_short_name, product_version, status
  FROM fnd_product_installations fpi
  JOIN fnd_application fa ON fa.application_id = fpi.application_id
 WHERE fa.application_short_name = 'FND';
EOF