CVE-2026-60794: Oracle TeleSales Auth Bypass Vulnerability

CVE-2026-60794 Overview

CVE-2026-60794 affects the Oracle TeleSales product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle TeleSales. Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle TeleSales data, and unauthorized read access to a subset of Oracle TeleSales data.

Critical Impact
An authenticated attacker with low privileges can modify and read Oracle TeleSales data over the network, impacting both confidentiality and integrity of business records.

Affected Products

Oracle E-Business Suite — Oracle TeleSales versions 12.2.3 through 12.2.15
Component: Internal Operations
Deployments exposing Oracle TeleSales over HTTP to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60794 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database
July 2026 - Addressed in the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-60794

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle TeleSales, an application within Oracle E-Business Suite used for managing customer sales interactions. An authenticated attacker holding low-privilege credentials can send crafted HTTP requests to the TeleSales interface and gain write access to records that should be restricted, along with read access to a subset of protected data. The scope remains unchanged, meaning exploitation affects resources managed by the vulnerable component itself.

Oracle's advisory characterizes the issue as easily exploitable, requiring no user interaction. The EPSS score is 0.24% (15.226 percentile), reflecting a low observed likelihood of exploitation at the time of publication, though internal-facing enterprise applications remain attractive targets for insiders and post-authentication attackers.

Root Cause

Oracle has not published the precise defect class in the public advisory. The behavior described - authenticated users obtaining read and write access to data outside their entitlement - is consistent with Broken Access Control weaknesses, where authorization checks on data-modifying operations are missing or inconsistent across HTTP endpoints exposed by the TeleSales Internal Operations component.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP endpoint and valid low-privileged credentials. The attacker issues HTTP requests to the vulnerable TeleSales interface to insert, update, or delete accessible records, and to read a subset of protected data. No user interaction is required, and the attack complexity is low.

No public proof-of-concept code is available. See the Oracle Security Alert - July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60794

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Oracle TeleSales tables originating from low-privileged application accounts.
HTTP requests to Oracle E-Business Suite TeleSales Internal Operations endpoints outside normal business patterns or from unusual source addresses.
Application audit log entries showing data access by users whose roles do not include TeleSales data modification.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate authenticated sessions with TeleSales endpoint access.
Baseline normal HTTP traffic to TeleSales URLs and alert on volumetric or off-hours deviations from low-privileged accounts.
Cross-reference database AUD$ or Fine-Grained Auditing (FGA) records against application-layer authorization policies to identify entitlement mismatches.

Monitoring Recommendations

Forward Oracle E-Business Suite web tier and database audit logs to a centralized SIEM for correlation with identity events.
Monitor for privilege changes and new session creation on TeleSales responsibilities immediately preceding data modification activity.
Track patch inventory for Oracle E-Business Suite 12.2.x deployments to confirm the July 2026 Critical Patch Update has been applied.

How to Mitigate CVE-2026-60794

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Oracle TeleSales.
Inventory user accounts with access to TeleSales responsibilities and remove entitlements that are not required for job function.
Restrict network access to the Oracle E-Business Suite HTTP tier so that only authorized users and networks can reach TeleSales endpoints.

Patch Information

Oracle addressed CVE-2026-60794 in the July 2026 Critical Patch Update. Administrators should follow the guidance published in the Oracle Security Alert - July 2026 and apply the corresponding patch for their Oracle E-Business Suite 12.2.x release. Oracle strongly recommends applying Critical Patch Updates without delay.

Workarounds

Restrict HTTP access to the TeleSales Internal Operations component to a minimal set of authenticated users pending patch deployment.
Enforce strong password policies and multi-factor authentication on all Oracle E-Business Suite accounts to reduce the pool of attackers meeting the low-privilege prerequisite.
Increase database and application audit granularity for TeleSales tables so that unauthorized modifications are recorded and reviewed.

bash

# Example: enable Fine-Grained Auditing on a TeleSales table to log DML by low-privileged users
BEGIN
  DBMS_FGA.ADD_POLICY(
    object_schema   => 'ONT',
    object_name     => 'AST_INTERACTIONS',
    policy_name     => 'FGA_TELESALES_DML',
    statement_types => 'INSERT,UPDATE,DELETE,SELECT',
    audit_trail     => DBMS_FGA.DB_EXTENDED
  );
END;
/