CVE-2026-60775: Oracle Pasta Privilege Escalation Flaw

CVE-2026-60775 Overview

CVE-2026-60775 affects the Pasta product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. An attacker with high privileges and local logon access to the infrastructure where Pasta executes can compromise the component. Successful exploitation results in a full takeover of Pasta, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows a locally authenticated, high-privileged attacker to take over the Pasta component and compromise the confidentiality, integrity, and availability of Oracle E-Business Suite Internal Operations.

Affected Products

Oracle E-Business Suite Pasta version 12.2.3 through 12.2.15
Component: Internal Operations
Deployments running the Pasta print server on supported EBS infrastructure

Discovery Timeline

2026-07-21 - CVE CVE-2026-60775 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60775

Vulnerability Analysis

The vulnerability resides in the Pasta product of Oracle E-Business Suite, which handles printing operations under Internal Operations. Pasta (Printing Any Sort of Text Abnormally) processes report output on the EBS application tier. The flaw permits a locally authenticated attacker with high privileges to escalate control over Pasta and its associated processing. Oracle classifies the exploitability as easy, meaning no specialized conditions beyond local access and elevated privileges are needed. The impact spans all three security properties, so an attacker can read protected data, modify print output or configuration, and disrupt printing services.

Root Cause

Oracle has not published the underlying weakness class or CWE identifier. Based on the advisory, the defect allows a privileged local user to influence Pasta execution in a way that yields full takeover of the component. No CWE identifiers were assigned in the NVD entry.

Attack Vector

The attack requires local access to the host running Pasta and a high-privilege account on that infrastructure. User interaction is not required, and the scope remains unchanged. Because privileges must already be elevated on the EBS application tier, this vulnerability is most relevant as a post-compromise lateral movement or persistence primitive rather than an initial access vector. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-60775

Indicators of Compromise

Unexpected modifications to Pasta configuration files or print queues on Oracle E-Business Suite application-tier hosts.
Anomalous process execution originating from the Pasta binary path or its parent EBS concurrent manager processes.
Local logons by administrative accounts outside of scheduled maintenance windows on the EBS application tier.

Detection Strategies

Audit authenticated local sessions on EBS application-tier hosts and correlate them with change events affecting Pasta.
Monitor filesystem integrity on the Pasta installation directory and related Internal Operations configuration paths.
Review Oracle EBS concurrent request logs for unusual print job submissions or output redirection.

Monitoring Recommendations

Forward operating system and Oracle EBS application logs to a centralized SIEM for correlation and long-term retention.
Alert on privilege elevation events for the applmgr and equivalent EBS service accounts.
Baseline normal Pasta execution patterns and alert on deviations in command-line arguments or child processes.

How to Mitigate CVE-2026-60775

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert July 2026 to all EBS environments running versions 12.2.3 through 12.2.15.
Inventory EBS deployments to confirm which application-tier hosts run the Pasta component.
Restrict local logon rights on EBS application-tier servers to the minimum set of administrators.
Rotate credentials for any privileged accounts that could reach the Pasta host if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60775 in the July 2026 Critical Patch Update. Administrators should download and apply the patch bundle for Oracle E-Business Suite 12.2 as described in the Oracle Security Alert July 2026. Verify the patch level after installation using adop or the equivalent EBS patching utility.

Workarounds

Enforce strict role separation so that only a narrow set of administrators holds high-privilege access on Pasta hosts.
Isolate the EBS application tier behind bastion hosts and require multi-factor authentication for administrative logon.
Enable OS-level auditing on Pasta binaries and configuration directories until the patch is deployed.

bash

# Verify EBS patch level after applying the July 2026 CPU
source $APPL_TOP/APPS<CONTEXT>.env
adop -status
adop phase=apply patches=<July2026_CPU_patch_id> apply=yes