CVE-2026-60784: Oracle Trading Community Auth Bypass Flaw

CVE-2026-60784 Overview

CVE-2026-60784 is a high-severity vulnerability in the Oracle Trading Community product of Oracle E-Business Suite, specifically within the Party Search UI component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue to compromise the Oracle Trading Community module. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Trading Community accessible data. Oracle addressed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker can read and modify all data accessible to the Oracle Trading Community module over the network with low attack complexity.

Affected Products

Oracle E-Business Suite — Oracle Trading Community, version 12.2.3
Oracle E-Business Suite — Oracle Trading Community, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Trading Community, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60784 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-60784

Vulnerability Analysis

The vulnerability resides in the Party Search UI component of Oracle Trading Community, a module of Oracle E-Business Suite that manages customer, partner, and organizational relationship data. The Party Search UI exposes HTTP-accessible search functionality that fails to properly enforce access controls on data operations. An attacker holding a low-privileged application account can send crafted HTTP requests to the Party Search UI and reach data beyond their authorized scope.

Exploitation results in high confidentiality and integrity impact. Attackers gain complete read access to Trading Community data and can create, delete, or modify records without authorization. Availability is not impacted. Because the attack does not require user interaction and only needs low privileges, exploitation is feasible for any account with network reachability to the E-Business Suite interface.

The EPSS score is 0.365% with a percentile of 29.038 as of 2026-07-23, indicating limited observed exploitation attempts to date.

Root Cause

Oracle has not published detailed root-cause information. Based on the vulnerability description and the affected UI component, the flaw stems from improper authorization enforcement in the Party Search UI request handlers. Data access checks are not applied consistently when servicing search and modification requests, allowing horizontal or vertical access beyond the authenticated user's scope.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. The attacker submits HTTP requests to the Party Search UI endpoints that trigger unauthorized data retrieval or modification. No user interaction is required, and the scope remains unchanged. See the Oracle Security Alert - July 2026 for vendor guidance.

No public proof-of-concept code or verified exploit is available at this time.

Detection Methods for CVE-2026-60784

Indicators of Compromise

Unexpected creation, modification, or deletion events on Trading Community HZ_PARTIES and related tables from low-privileged accounts
Unusual volumes of HTTP requests to Party Search UI endpoints from a single session or source IP
Application audit records showing party data access by users outside their expected functional responsibility

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for the Trading Community responsibility
Correlate database-level auditing on Trading Community tables with application user sessions to identify authorization anomalies
Baseline normal Party Search UI usage per role and alert on deviations in query volume or record modification counts

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized SIEM for long-term retention and correlation
Monitor for repeated HTTP requests to /OA_HTML/ paths associated with the Party Search UI from non-administrative accounts
Track failed and successful privilege changes on Trading Community responsibilities and menus

How to Mitigate CVE-2026-60784

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15
Inventory all low-privileged accounts with access to the Trading Community responsibility and validate business need
Restrict network access to the E-Business Suite HTTP interface to trusted internal networks and VPN users
Rotate credentials for any accounts suspected of unauthorized use prior to patching

Patch Information

Oracle addressed CVE-2026-60784 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patch for Oracle E-Business Suite 12.2.x as documented in the Oracle Critical Patch Update Advisory - July 2026. Follow Oracle's recommended patch application procedure, which includes running adop in hotpatch or downtime mode depending on the environment.

Workarounds

Temporarily remove the Party Search UI function from low-privileged responsibilities until patching is complete
Place a web application firewall in front of the E-Business Suite web tier with rules limiting access to Party Search UI endpoints by source and role
Enforce multi-factor authentication and session restrictions on all E-Business Suite accounts to reduce the pool of exploitable credentials

bash

# Verify current E-Business Suite patch level before and after applying July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<july2026_cpu_bug_id>')
 ORDER BY last_update_date DESC;
EOF

# Apply the CPU patch using adop (example - substitute actual patch number)
adop phase=apply patches=<july2026_cpu_patch> hotpatch=yes