CVE-2026-60790: Oracle Sales Offline Privilege Escalation

CVE-2026-60790 Overview

CVE-2026-60790 is a vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation is considered difficult. Because the vulnerability introduces a scope change, attacks may significantly impact additional products beyond Oracle Sales Offline itself. Successful exploitation results in full takeover of Oracle Sales Offline, with high impact to confidentiality, integrity, and availability.

Critical Impact
Successful exploitation results in takeover of Oracle Sales Offline and may compromise additional products through scope change, impacting confidentiality, integrity, and availability.

Affected Products

Oracle E-Business Suite — Oracle Sales Offline version 12.2.3
Oracle E-Business Suite — Oracle Sales Offline versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Sales Offline version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60790 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60790

Vulnerability Analysis

CVE-2026-60790 resides in the Internal Operations component of Oracle Sales Offline, a module within Oracle E-Business Suite. The vulnerability allows a high-privileged authenticated attacker to compromise the Sales Offline product over the network using HTTP.

Exploitation requires elevated privileges and specialized conditions, which raises the attack complexity. However, the scope change indicates that a successful attack extends beyond the vulnerable component and can affect resources managed by other security authorities within the E-Business Suite deployment. Oracle rates the confidentiality, integrity, and availability impacts as high, consistent with full takeover of the affected product.

Root Cause

Oracle has not published the specific technical root cause in the public advisory. The July 2026 Critical Patch Update identifies the flaw within the Internal Operations component of Oracle Sales Offline and confirms that authentication with high privileges is required. Detailed internal analysis is restricted to Oracle customers through My Oracle Support.

Attack Vector

The attack vector is network-based over HTTP. An attacker must already hold high privileges within the Oracle E-Business Suite environment and must satisfy conditions that make exploitation difficult. Once these prerequisites are met, the attacker can send crafted HTTP requests to the Internal Operations interface to take over Oracle Sales Offline and pivot into additional in-scope products.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Critical Patch Update - July 2026 for the vendor advisory.

Detection Methods for CVE-2026-60790

Indicators of Compromise

Unexpected authenticated HTTP requests targeting Oracle Sales Offline Internal Operations endpoints from administrative or service accounts.
Anomalous configuration changes or new administrative sessions within Oracle E-Business Suite 12.2.3-12.2.15 environments.
Cross-product access from Oracle Sales Offline processes to other E-Business Suite modules that would indicate scope-change exploitation.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On audit logs and FND (Foundation) audit trails for privileged account activity against Sales Offline.
Baseline normal HTTP traffic patterns to /OA_HTML/ and Sales Offline URLs, then alert on deviations from privileged sessions.
Correlate Oracle application-tier logs with web-tier access logs to identify suspicious multi-product access chains consistent with scope change.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized SIEM for continuous review.
Monitor changes to profile options, responsibilities, and user privileges tied to Sales Offline and Internal Operations.
Alert on privileged account logins outside of maintenance windows or from unexpected source addresses.

How to Mitigate CVE-2026-60790

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15.
Inventory all instances of Oracle Sales Offline and confirm patch status through My Oracle Support.
Rotate and audit credentials for high-privileged Oracle E-Business Suite accounts that could satisfy the exploitation prerequisites.

Patch Information

Oracle addressed CVE-2026-60790 in the July 2026 Critical Patch Update. Customers should download and apply the fixes referenced in the Oracle Critical Patch Update Advisory - July 2026. Oracle strongly recommends applying Critical Patch Update fixes as soon as possible, as unpatched systems remain exposed to takeover of Oracle Sales Offline and potential impact to other in-scope products.

Workarounds

Restrict HTTP access to Oracle Sales Offline Internal Operations endpoints to trusted administrative networks only.
Enforce least privilege for E-Business Suite responsibilities, reducing the population of accounts capable of meeting the high-privilege exploitation requirement.
Enable multi-factor authentication for privileged Oracle E-Business Suite accounts where supported by the deployment.

bash

# Example: restrict access to EBS Sales Offline URLs at the web tier
# Apache httpd configuration snippet for Oracle HTTP Server
<Location /OA_HTML/>
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Deny all other sources
</Location>