CVE-2026-60799: Oracle Compensation Workbench Auth Bypass

CVE-2026-60799 Overview

CVE-2026-60799 affects the Oracle Compensation Workbench component within Oracle E-Business Suite versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise the application. Successful exploitation grants unauthorized access to critical data across all Compensation Workbench accessible records. The attacker can also perform unauthorized update, insert, or delete operations against a subset of that data. Oracle published the vulnerability in its July 2026 Critical Patch Update advisory.

Critical Impact
Authenticated attackers can read all Compensation Workbench data and modify records over the network with low attack complexity.

Affected Products

Oracle E-Business Suite — Oracle Compensation Workbench 12.2.3
Oracle E-Business Suite — Oracle Compensation Workbench versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Compensation Workbench 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60799 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60799

Vulnerability Analysis

CVE-2026-60799 resides in the Oracle Compensation Workbench module of Oracle E-Business Suite, a web-facing human capital management component. The flaw is reachable over HTTP and requires only low-level authentication, meaning any user with a valid application session can attempt exploitation. Oracle's advisory indicates the impact spans confidentiality of all Compensation Workbench data and integrity of a subset of that data, with no availability impact. Compensation Workbench stores salary, bonus, stock, and performance data, so unauthorized read access exposes sensitive workforce compensation records.

Root Cause

Oracle has not published the underlying weakness class. The CVSS profile — network attack vector, low complexity, low privileges required, no user interaction — is consistent with a server-side access control or input handling flaw within an authenticated Oracle E-Business Suite session. No CWE identifier has been assigned in the NVD entry.

Attack Vector

An attacker authenticates to Oracle E-Business Suite using any low-privileged account, then issues crafted HTTP requests to Compensation Workbench endpoints. Because privileges required are low and no user interaction is needed, exploitation can be scripted. The scope is unchanged, so impact remains within the vulnerable component, but exposed data spans all records the application handles.

No public proof-of-concept exploit is available at this time. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60799

Indicators of Compromise

Anomalous HTTP requests to Compensation Workbench URLs originating from low-privileged user sessions.
Bulk record retrieval or export events against compensation tables outside normal business hours.
Unexpected UPDATE, INSERT, or DELETE activity in Compensation Workbench audit logs.
Session activity from accounts that historically do not access compensation modules.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Compensation Workbench responsibility.
Correlate application-tier access logs with database audit records to identify session-to-query mismatches.
Baseline expected access patterns per user role and alert on deviations targeting compensation data.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized SIEM for correlation.
Monitor authentication events for accounts accessing Compensation Workbench after the CVE publication date.
Track outbound data volumes from the Oracle E-Business Suite application tier to detect exfiltration.

How to Mitigate CVE-2026-60799

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.x environments running Compensation Workbench.
Inventory all Oracle E-Business Suite instances and confirm the patched version is present on production, disaster recovery, and test tiers.
Review recent Compensation Workbench audit records for unauthorized read or write activity.
Rotate credentials for any low-privileged accounts showing suspicious activity against the module.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Consult the Oracle Security Alert July 2026 for the specific patch identifiers, prerequisites, and application instructions for Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Restrict network access to Oracle E-Business Suite Compensation Workbench URLs to trusted internal networks via reverse proxy or WAF rules.
Temporarily remove the Compensation Workbench responsibility from users who do not require it until patching is complete.
Enforce stronger authentication controls, including multi-factor authentication, for all Oracle E-Business Suite user accounts.

bash

# Configuration example: restrict access at the reverse proxy tier
# Example Apache httpd rule limiting Compensation Workbench to internal CIDR
<Location /OA_HTML/OA.jsp>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>