CVE-2026-60802: Oracle E-Business Intelligence Auth Bypass

CVE-2026-60802 Overview

CVE-2026-60802 is a vulnerability in the Internal Operations component of Oracle E-Business Intelligence, part of the Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, but successful attacks require human interaction from a user other than the attacker. Although the vulnerability resides in Oracle E-Business Intelligence, exploitation can impact additional products due to a scope change.

Critical Impact
Successful exploitation allows unauthorized update, insert, or delete access to data accessible to Oracle E-Business Intelligence, plus unauthorized read access to a subset of that data.

Affected Products

Oracle E-Business Intelligence 12.2.3 through 12.2.15
Oracle E-Business Suite (Internal Operations component)
Downstream products affected by scope change

Discovery Timeline

2026-07-21 - CVE-2026-60802 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update (July 2026)

Technical Details for CVE-2026-60802

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle E-Business Intelligence. The attack vector is network-based over HTTP, and exploitation requires no authentication. However, the attacker must convince a legitimate user to perform an action, typically by clicking a crafted link or loading a malicious page.

The scope change indicates that exploitation can impact resources beyond the vulnerable component. This behavior is consistent with client-side injection issues where a payload executes in a security context different from the vulnerable application itself. The confidentiality and integrity impacts are limited, and there is no direct availability impact.

The EPSS score of 0.238% at the 14.93 percentile indicates a relatively low predicted probability of exploitation activity in the near term, though this metric does not reduce the need to patch.

Root Cause

Oracle has not disclosed low-level technical details in the July 2026 Critical Patch Update advisory. The combination of user interaction requirement, scope change, and low confidentiality and integrity impact points to insufficient output sanitization or input validation in a web-facing interface within the Internal Operations component. Attackers can leverage this weakness to have malicious content processed within a victim's authenticated session.

Attack Vector

An unauthenticated attacker delivers a crafted URL or web content targeting the Oracle E-Business Intelligence Internal Operations interface. When a user with an active session interacts with the crafted content, the payload executes against Oracle E-Business Intelligence resources. Due to the scope change, actions performed can affect additional Oracle E-Business Suite modules that share trust with the compromised session.

No verified proof-of-concept code is publicly available. See the Oracle Critical Patch Update - July 2026 for vendor guidance.

Detection Methods for CVE-2026-60802

Indicators of Compromise

Unusual HTTP requests to Oracle E-Business Intelligence Internal Operations endpoints containing encoded scripts or unexpected parameters
Web server access logs showing referrers from untrusted external domains directing users into E-Business Suite URLs
Unexpected UPDATE, INSERT, or DELETE operations in Oracle E-Business Intelligence audit tables tied to interactive user sessions

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to Oracle E-Business Suite paths for reflected script content and malformed parameters
Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate user sessions with anomalous data modifications
Monitor outbound referrer traffic from E-Business Suite pages to detect exfiltration or callbacks to attacker-controlled domains

Monitoring Recommendations

Aggregate Oracle application server access logs and database audit logs into a central analytics platform for cross-correlation
Alert on privileged data changes in Oracle E-Business Intelligence that occur within seconds of external HTTP referrers
Track failed and successful authentication events from IP ranges that also target the Internal Operations component

How to Mitigate CVE-2026-60802

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15
Inventory Oracle E-Business Intelligence instances exposed to untrusted networks and prioritize patching those first
Notify users of the phishing risk associated with unsolicited links referencing E-Business Suite URLs

Patch Information

Oracle addressed CVE-2026-60802 in the Oracle Critical Patch Update - July 2026. Administrators should review the advisory for the specific patch identifiers matching their E-Business Suite release and apply them following Oracle's standard patching procedures.

Workarounds

Restrict network access to Oracle E-Business Intelligence Internal Operations interfaces to trusted management networks using firewall rules or reverse proxy access control lists
Deploy a WAF in front of Oracle E-Business Suite with rules that block reflected script payloads and enforce strict Content-Type and referrer checks
Enforce short session timeouts and require re-authentication for privileged E-Business Intelligence operations to reduce the window for user-interaction-based attacks

bash

# Example: restrict access to E-Business Intelligence endpoints at the reverse proxy
# (Apache httpd) - allow only trusted management CIDR ranges
<Location "/OA_HTML/">
    Require ip 10.20.30.0/24
    Require ip 192.168.100.0/24
</Location>