CVE-2026-60774: Oracle E-Business Auth Bypass Vulnerability

CVE-2026-60774 Overview

CVE-2026-60774 affects the Oracle Applications Framework within Oracle E-Business Suite, specifically the Search Bean component including Advanced Search. Oracle disclosed the flaw in its July 2026 Critical Patch Update. A low-privileged attacker with network access via HTTP can compromise the Oracle Applications Framework without user interaction. Successful exploitation results in unauthorized access to critical data and unauthorized modification of a subset of Framework-accessible data. Supported versions 12.2.3 through 12.2.15 are affected.

Critical Impact
An authenticated attacker with minimal privileges can read all data accessible to the Oracle Applications Framework and perform unauthorized insert, update, or delete operations against a subset of that data over the network.

Affected Products

Oracle E-Business Suite — Oracle Applications Framework 12.2.3 through 12.2.15
Search Bean component (including Advanced Search)
Deployments exposing the Applications Framework over HTTP to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60774 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle published the vulnerability in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60774

Vulnerability Analysis

The vulnerability resides in the Search Bean component of the Oracle Applications Framework, the presentation and controller layer used by many Oracle E-Business Suite modules. An attacker requires only a low-privileged authenticated session and network access via HTTP. Exploitation does not require user interaction and does not cross a security boundary, keeping the scope unchanged. The impact profile is high on confidentiality, low on integrity, and none on availability. This pattern is consistent with an input handling flaw in search parameter processing that allows an authenticated user to retrieve or modify data outside their authorization scope.

Root Cause

Oracle has not publicly disclosed the specific defect class. Based on the affected component (Search Bean including Advanced Search) and the impact profile of broad read access with partial write access, the issue is consistent with insufficient authorization enforcement on search parameters or query construction inside the Applications Framework. The Search Bean processes user-supplied query criteria, and inadequate validation of those criteria against the caller's data access privileges permits access to records that should be out of scope.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold a valid low-privileged Oracle E-Business Suite account. From an authenticated session, the attacker issues crafted requests to Applications Framework endpoints that consume the Search Bean. The server returns data beyond the caller's authorization and accepts a subset of modification requests. No client interaction is required, and attack complexity is low.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-60774 as of publication. The EPSS score is 0.303% (percentile 22.4). Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor technical details.

Detection Methods for CVE-2026-60774

Indicators of Compromise

Authenticated Applications Framework requests targeting Search Bean URLs (typically containing OA.jsp with search-related parameters) at rates or volumes inconsistent with the user's role.
Application audit records showing a low-privileged account viewing or exporting business objects outside its assigned responsibilities.
Unexpected insert, update, or delete operations in Framework-backed tables originating from accounts without functional access to those modules.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking, then baseline Search Bean access per responsibility to flag deviations.
Correlate Oracle HTTP Server access logs with application session data to identify authenticated users issuing high-volume or anomalous search requests.
Review database audit trails for Framework service accounts performing reads or writes across tables that fall outside the invoking responsibility's grants.

Monitoring Recommendations

Ingest Oracle E-Business Suite application, HTTP server, and database audit logs into a centralized analytics platform for correlation.
Alert on repeated 200 OK responses to Search Bean endpoints with atypically large result sets returned to non-privileged accounts.
Monitor for privilege drift: low-privileged accounts touching modules or record sets they have never accessed historically.

How to Mitigate CVE-2026-60774

Immediate Actions Required

Apply the Oracle E-Business Suite patches from the July 2026 Critical Patch Update to all Applications Framework deployments running versions 12.2.3 through 12.2.15.
Inventory all internet-exposed E-Business Suite instances and prioritize them for patching before internal-only environments.
Rotate credentials for any low-privileged accounts that may have been exposed or shared, and review recent account provisioning.
Audit Applications Framework access logs for the period preceding patch application to identify potential unauthorized data access.

Patch Information

Oracle addressed CVE-2026-60774 in the July 2026 Critical Patch Update. Administrators must apply the E-Business Suite patch set that covers the Oracle Applications Framework Search Bean component. Consult the Oracle Critical Patch Update Advisory - July 2026 for the exact patch identifiers, prerequisites, and My Oracle Support notes applicable to versions 12.2.3 through 12.2.15.

Workarounds

Restrict network access to Oracle E-Business Suite Applications Framework endpoints using a reverse proxy or web application firewall until patches are applied.
Tighten responsibility and menu assignments so low-privileged users cannot reach Advanced Search functions that are not required for their role.
Enable and closely review Oracle E-Business Suite auditing on sensitive modules to shorten identification time for anomalous search activity.

No vendor-supported configuration workaround fully remediates CVE-2026-60774; patching remains the required fix.