CVE-2026-60785: Oracle iReceivables Auth Bypass Flaw

CVE-2026-60785 Overview

CVE-2026-60785 affects the Oracle iReceivables product within Oracle E-Business Suite, specifically the AR Web Utilities component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle iReceivables. Successful exploitation results in full takeover of the iReceivables application, impacting confidentiality, integrity, and availability. Oracle disclosed the issue as part of the July 2026 Critical Patch Update. Although the attack complexity is high, the network-accessible attack surface and lack of authentication requirement make this a priority patching item for any organization running affected Oracle E-Business Suite deployments.

Critical Impact
Successful exploitation permits an unauthenticated remote attacker to take over Oracle iReceivables, compromising the confidentiality, integrity, and availability of receivables data and connected workflows.

Affected Products

Oracle E-Business Suite — Oracle iReceivables 12.2.3
Oracle E-Business Suite — Oracle iReceivables (versions 12.2.4 through 12.2.14)
Oracle E-Business Suite — Oracle iReceivables 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60785 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60785

Vulnerability Analysis

The vulnerability resides in the AR Web Utilities component of Oracle iReceivables, a web-facing module of Oracle E-Business Suite used for customer receivables self-service. An unauthenticated attacker communicating over HTTP can reach the affected component without providing credentials or user interaction. A successful attack yields complete takeover of Oracle iReceivables, meaning the attacker can read, modify, and disrupt receivables data and application functions.

Oracle classifies the exploitation difficulty as high, indicating that specific conditions or techniques must be satisfied before the attack succeeds. The scope remains unchanged, so impact is contained within the vulnerable component's security authority, but that authority typically includes sensitive financial records and integrations with other E-Business Suite modules.

The EPSS probability is 0.376% at the time of publication, reflecting no observed in-the-wild exploitation. However, Oracle E-Business Suite has a long history of being targeted after Critical Patch Update disclosures, and internet-exposed iReceivables portals materially expand the attack surface.

Root Cause

Oracle has not published detailed root cause information. The advisory identifies AR Web Utilities as the vulnerable component and confirms that no authentication is required to reach the flaw over HTTP. Further technical detail is restricted to Oracle customers under the responsible disclosure terms of the Oracle Critical Patch Update Advisory.

Attack Vector

The attack vector is network-based over HTTP against the iReceivables web interface. No credentials and no user interaction are required. An attacker capable of reaching the AR Web Utilities endpoints, whether from the public internet or an adjacent internal network, can attempt exploitation and, if successful, gain full control over the iReceivables application context.

Refer to the Oracle Critical Patch Update Advisory for exploitation prerequisites and vendor guidance. No public proof-of-concept has been released.

Detection Methods for CVE-2026-60785

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to iReceivables AR Web Utilities URLs from unexpected external sources.
Anomalous application errors, stack traces, or 500-series responses generated by iReceivables endpoints in access_log and Oracle HTTP Server logs.
Unexpected creation, modification, or export of receivables records without a corresponding authenticated session.
New administrative or service account activity within Oracle E-Business Suite following inbound requests to iReceivables.

Detection Strategies

Inventory internet-exposed Oracle E-Business Suite deployments and confirm which host the iReceivables module.
Enable verbose logging on Oracle HTTP Server and correlate access patterns to AR Web Utilities paths with source IP reputation data.
Deploy web application firewall rules to inspect and rate-limit unauthenticated requests to iReceivables URIs.
Baseline normal request volume and parameter patterns for iReceivables and alert on statistical deviations.

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and database audit logs to a centralized SIEM for correlation.
Monitor Oracle E-Business Suite FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, and receivables audit tables for unexpected changes.
Alert on outbound connections initiated by the E-Business Suite application tier to non-approved destinations.
Track patch state of every E-Business Suite instance and flag any host still running versions 12.2.3 through 12.2.15 without the July 2026 CPU applied.

How to Mitigate CVE-2026-60785

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every affected Oracle E-Business Suite 12.2.3–12.2.15 environment.
Restrict network exposure of iReceivables to trusted networks and require VPN or reverse proxy authentication where feasible.
Review Oracle HTTP Server and iReceivables access logs for suspicious unauthenticated traffic since exposure began.
Rotate credentials and API keys used by the iReceivables application tier if compromise is suspected.

Patch Information

Oracle addresses CVE-2026-60785 in the July 2026 Critical Patch Update. Administrators should follow the version-specific patch guidance in the Oracle Critical Patch Update Advisory and validate patch application in a staging environment prior to production rollout. All Oracle iReceivables versions from 12.2.3 through 12.2.15 require the corresponding fix.

Workarounds

Place iReceivables behind a reverse proxy or web application firewall that blocks unauthenticated access to AR Web Utilities endpoints until the patch is applied.
Disable or restrict the iReceivables module in environments that do not require external customer access.
Enforce strict IP allow-listing on the application tier to limit exposure to known partner and customer networks.
Increase logging verbosity and monitoring coverage on the E-Business Suite application tier during the mitigation window.

bash

# Example: block unauthenticated external access to iReceivables paths at the reverse proxy
# (adjust paths and networks to your environment)
location ~* ^/OA_HTML/(ARW|AR).* {
    allow 10.0.0.0/8;
    deny  all;
}