CVE-2026-60773: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60773 Overview

CVE-2026-60773 affects the Oracle Application Object Library component within Oracle E-Business Suite. The flaw resides in the Core component and impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTPS can exploit the vulnerability without user interaction. The issue carries a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself. Attackers can gain unauthorized read access to all accessible data and perform unauthorized creation, deletion, or modification of critical records.

Critical Impact
Authenticated attackers can compromise confidentiality and integrity of Oracle Application Object Library data and impact additional Oracle E-Business Suite products through scope change.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Application Object Library (Core component)
Downstream Oracle E-Business Suite modules affected via scope change

Discovery Timeline

2026-07-21 - CVE-2026-60773 published to NVD
2026-07-21 - Oracle Critical Patch Update advisory released
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60773

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Application Object Library, the foundational framework underpinning Oracle E-Business Suite modules. Oracle classifies the flaw as easily exploitable and reachable over the network via HTTPS. An attacker holding low-privileged credentials can compromise the Application Object Library without user interaction.

The scope change indicator signals that exploitation crosses trust boundaries. A successful attack against the Application Object Library can influence data and behavior in other Oracle E-Business Suite products that depend on it. Confidentiality and integrity impacts are both rated high; availability is not affected.

Because Oracle Application Object Library brokers authentication, session context, concurrent processing, and metadata for the wider suite, exploitation gives attackers a path to sensitive business records including financial, procurement, and human resources data managed by dependent modules.

Root Cause

Oracle has not disclosed the underlying defect. The advisory indicates the issue is exploitable by an authenticated but low-privileged network user and results in unauthorized data access and modification with a scope change to other suite components. Refer to the Oracle Security Alert July 2026 for vendor detail.

Attack Vector

Exploitation requires network access over HTTPS to an exposed Oracle E-Business Suite deployment and valid low-privileged credentials. No user interaction is needed. Attackers with basic application accounts, including self-registered or shared functional users, can reach the vulnerable Core interfaces and pivot into higher-value data across the suite.

No verified public exploit code is available. The EPSS probability is 0.365%.

Detection Methods for CVE-2026-60773

Indicators of Compromise

Unexpected create, update, or delete operations against Application Object Library tables from low-privileged user contexts
Anomalous HTTPS requests to Oracle E-Business Suite endpoints originating from non-administrative accounts
Session activity from application accounts accessing modules outside their assigned responsibilities

Detection Strategies

Correlate Oracle E-Business Suite application logs with database audit trails to identify privilege boundary crossings
Baseline normal request patterns for /OA_HTML/ and Application Object Library servlets, then alert on deviations
Monitor concurrent manager submissions initiated by accounts that do not typically run administrative jobs

Monitoring Recommendations

Enable Oracle database fine-grained auditing on Application Object Library schema objects
Ship Oracle E-Business Suite access logs and database audit records to a centralized SIEM for retention and analysis
Track failed authorization checks and responsibility switches that precede sensitive data access

How to Mitigate CVE-2026-60773

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite without delay
Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and prioritize internet-exposed systems
Review and reduce standing low-privileged accounts that can authenticate to the suite
Rotate credentials for accounts that showed anomalous activity prior to patching

Patch Information

Oracle addressed CVE-2026-60773 in the Oracle Security Alert July 2026. Administrators must apply the referenced Critical Patch Update for Oracle E-Business Suite to remediate the vulnerability. No official workaround eliminates the flaw outside of patching.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers using firewall rules, VPN gating, or reverse proxy allow-lists
Enforce multi-factor authentication for all Oracle E-Business Suite accounts to raise the cost of credential abuse
Disable or lock unused low-privileged application accounts and audit responsibility assignments

bash

# Verify Oracle E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_PATCH_ID>')
 ORDER BY last_update_date DESC;
EOF