CVE-2026-60771: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60771 Overview

CVE-2026-60771 is a high-severity vulnerability in the Oracle Complex Maintenance, Repair and Overhaul (cMRO) product within Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this vulnerability without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through Oracle cMRO. Oracle disclosed the issue in the Oracle Security Alert - July 2026.

Critical Impact
Authenticated network attackers can compromise confidentiality and integrity of all data accessible through Oracle Complex Maintenance, Repair and Overhaul.

Affected Products

Oracle E-Business Suite - Complex Maintenance, Repair and Overhaul 12.2.3 through 12.2.15
Component: Internal Operations
Deployments exposing cMRO HTTP endpoints to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60771 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60771

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul, a module used by asset-intensive industries such as aviation and defense to manage maintenance workflows. An attacker requires only low privileges and network access over HTTP to reach the vulnerable endpoint. The flaw impacts confidentiality and integrity but not availability, indicating a broken access control or authorization issue rather than a service-crashing memory defect. Successful exploitation grants an authenticated attacker the ability to read, alter, or delete records across the full data scope of the cMRO product. The EPSS score is 0.365%, reflecting current low observed exploitation likelihood.

Root Cause

Oracle has not published detailed root cause information beyond the advisory. Based on the CVSS metrics and impact profile, the vulnerability aligns with a Broken Access Control or Authorization Bypass class weakness. The Internal Operations component appears to permit low-privileged accounts to invoke operations that should require higher entitlements or narrower record-level scoping.

Attack Vector

Exploitation requires HTTP access to a reachable cMRO endpoint and any valid low-privileged Oracle E-Business Suite account. No user interaction is needed, and attack complexity is low. Threat actors with foothold credentials obtained through phishing, credential stuffing, or insider access can pivot directly to the vulnerable module. Because Oracle E-Business Suite is frequently exposed through corporate portals and integrated single sign-on, credential compromise on any adjacent system may enable this attack. No public exploit or proof-of-concept has been observed at the time of publication. Refer to the Oracle Security Alert - July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60771

Indicators of Compromise

Unexpected create, update, or delete operations against cMRO records performed by low-privileged accounts
Anomalous HTTP requests to Internal Operations endpoints outside normal business workflow patterns
Access to cMRO data by user accounts that do not have a business role tied to maintenance operations

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the cMRO responsibility
Correlate application-tier audit logs with database FND_LOGINS and FND_UNSUCCESSFUL_LOGINS tables to spot lateral movement
Baseline normal cMRO transaction volume per user and alert on statistical deviations

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized SIEM for correlation
Monitor privileged and service accounts for authentication from unusual source addresses
Track outbound data volumes from Oracle E-Business Suite hosts to identify potential bulk data extraction

How to Mitigate CVE-2026-60771

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as soon as testing permits
Inventory all cMRO deployments running versions 12.2.3 through 12.2.15 and prioritize internet-exposed instances
Review and reduce the population of accounts holding cMRO responsibilities to enforce least privilege
Rotate credentials for any account showing anomalous cMRO activity

Patch Information

Oracle released fixes for CVE-2026-60771 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - July 2026 for the specific patch identifiers, prerequisites, and post-installation validation steps applicable to their Oracle E-Business Suite 12.2 environment.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using perimeter controls, VPN, or zero trust network access
Disable or restrict the cMRO responsibility for user populations that do not require it until patching is complete
Enforce multi-factor authentication for all Oracle E-Business Suite users to raise the cost of credential-based access

bash

# Example: restrict cMRO URLs at the reverse proxy until patched
location ~* /OA_HTML/.*(cMRO|MaintenanceRepair).* {
    allow 10.0.0.0/8;
    deny all;
}