CVE-2026-60795: Oracle iSetup Auth Bypass Vulnerability

CVE-2026-60795 Overview

CVE-2026-60795 affects the Oracle iSetup product within Oracle E-Business Suite, specifically the General Ledger Update Transform and Reports component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle iSetup, though exploitation is difficult and requires specific conditions. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle iSetup accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can achieve unauthorized read and write access to all data accessible by Oracle iSetup, compromising confidentiality and integrity of General Ledger transform and reporting data.

Affected Products

Oracle E-Business Suite — Oracle iSetup 12.2.3
Oracle E-Business Suite — Oracle iSetup versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle iSetup 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60795 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60795

Vulnerability Analysis

CVE-2026-60795 resides in the General Ledger Update Transform and Reports component of Oracle iSetup, a configuration management tool within Oracle E-Business Suite. The flaw permits an authenticated user holding low-level application privileges to influence transform or reporting operations in ways that bypass intended data access boundaries. Because the attack surface is exposed over HTTP, adversaries can attempt exploitation remotely once they possess valid credentials. The vulnerability yields high confidentiality and integrity impact but does not affect availability.

Oracle classifies the exploitation as difficult, indicating that additional conditions beyond a single crafted request are required. Typical difficulty factors in Oracle E-Business Suite issues include timing dependencies, prerequisite configuration states, or reliance on specific user roles being present. Attackers who successfully chain these prerequisites obtain the ability to read, create, modify, or delete iSetup-accessible business data.

Root Cause

The root cause lies in insufficient authorization enforcement within the General Ledger Update Transform and Reports code paths of Oracle iSetup. Requests processed by these components do not adequately validate whether the invoking user is entitled to the target dataset. This constitutes a broken access control weakness in a server-side business application.

Attack Vector

Exploitation requires network access over HTTP and a low-privileged authenticated session. No user interaction from a victim is required. The scope remains unchanged, meaning the impact is contained within the vulnerable component and its data set. Oracle has not published proof-of-concept exploit code, and no public exploit is currently available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60795

Indicators of Compromise

Anomalous HTTP requests to Oracle iSetup endpoints associated with General Ledger Update Transform or Reports functionality.
Unexpected creation, modification, or deletion of General Ledger configuration records by low-privileged accounts.
Application audit log entries showing iSetup transform or report execution outside normal business change windows.

Detection Strategies

Enable Oracle E-Business Suite auditing on iSetup modules and forward audit records to a centralized log platform for correlation.
Baseline typical iSetup usage per user role and alert on deviations, particularly reads or writes exceeding a user's normal scope.
Monitor web tier access logs for repeated or malformed requests targeting iSetup transform and report URLs.

Monitoring Recommendations

Track authentication events for accounts with any iSetup responsibility, alerting on logins from atypical locations or times.
Correlate database change records with application-level user context to identify writes not tied to legitimate iSetup workflows.
Review privileged access reports monthly to ensure the least-privilege principle is applied to iSetup responsibilities.

How to Mitigate CVE-2026-60795

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15.
Inventory user accounts assigned to Oracle iSetup responsibilities and remove entitlements that are not operationally required.
Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted enterprise networks and VPN users.

Patch Information

Oracle published fixes as part of the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 advisory and apply the corresponding patch bundles to each affected 12.2.x instance. Test patches in a non-production environment before production rollout given the operational sensitivity of General Ledger data.

Workarounds

Temporarily disable or restrict access to the Oracle iSetup responsibility for non-essential users until patching is complete.
Place a web application firewall in front of the Oracle E-Business Suite web tier and block requests to iSetup transform and report paths from untrusted sources.
Increase audit logging verbosity on iSetup activity to detect exploitation attempts during the patch window.

bash

# Example: restrict access to iSetup URLs at the web tier via Apache/OHS configuration
<Location /OA_HTML/oracle/apps/az/>
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Location>