CVE-2026-60811: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60811 Overview

CVE-2026-60811 is a vulnerability in the Oracle Supply Chain Trading Connector component of Oracle E-Business Suite, specifically within the Collaboration History module. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized update, insert, or delete access to a subset of application data, unauthorized read access to a portion of accessible data, and the ability to cause a partial denial of service. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Authenticated attackers can tamper with supply chain trading data and partially disrupt the Supply Chain Trading Connector service over the network.

Affected Products

Oracle E-Business Suite — Supply Chain Trading Connector 12.2.3
Oracle E-Business Suite — Supply Chain Trading Connector versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Supply Chain Trading Connector 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60811 published to the National Vulnerability Database
2026-07-21 - Oracle publishes the July 2026 Security Alert covering this issue
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60811

Vulnerability Analysis

The vulnerability resides in the Collaboration History component of the Oracle Supply Chain Trading Connector. The component is reachable over HTTP and exposes functionality that fails to adequately enforce authorization or validate input against the caller's privilege scope. An authenticated user with low privileges can send crafted HTTP requests to reach data operations that should be restricted.

The result is a broken access control condition affecting confidentiality, integrity, and availability of the module. Confidentiality impact is limited to a subset of readable data. Integrity impact allows unauthorized update, insert, or delete of records handled by the connector. Availability impact is partial, meaning attackers can degrade but not fully disable the service.

EPSS currently scores the vulnerability at 0.272% (19.235 percentile) as of 2026-07-23, indicating low observed exploitation likelihood at disclosure. No public proof-of-concept or exploit code is available at the time of writing.

Root Cause

Oracle has not published low-level technical details for this issue. Based on the advisory language and impact profile, the root cause is insufficient authorization enforcement in one or more Collaboration History request handlers within the Supply Chain Trading Connector. Low-privileged sessions can invoke operations that should be gated by stronger role checks.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite instance and a valid low-privileged account on the Supply Chain Trading Connector application. The attacker sends HTTP requests to affected Collaboration History endpoints. No user interaction is required, and attack complexity is low. See the Oracle Security Alert July 2026 for vendor-supplied risk matrix details.

No verified exploit code is published for CVE-2026-60811. Refer to the Oracle advisory for the definitive component and version matrix.

Detection Methods for CVE-2026-60811

Indicators of Compromise

Unexpected HTTP requests from low-privileged application accounts targeting Collaboration History endpoints in the Supply Chain Trading Connector module
Unauthorized INSERT, UPDATE, or DELETE operations recorded in Oracle E-Business Suite audit tables for trading partner collaboration records
Anomalous partial outages or elevated error rates on the Supply Chain Trading Connector service

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for Supply Chain Trading Connector responsibilities
Correlate application-tier HTTP access logs with database change auditing to flag data modifications performed by accounts that should not have write access
Baseline normal request patterns for Collaboration History URIs and alert on deviations from low-privileged users

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized SIEM for correlation
Monitor for authentication attempts and session activity originating from unexpected network segments
Track failed and successful privilege changes on Supply Chain Trading Connector responsibilities

How to Mitigate CVE-2026-60811

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as described in the Oracle Security Alert July 2026
Inventory all Oracle E-Business Suite deployments and confirm which run Supply Chain Trading Connector versions 12.2.3 through 12.2.15
Restrict network reachability of the Supply Chain Trading Connector endpoints to trusted internal networks and VPN users
Review and reduce Supply Chain Trading Connector responsibility assignments to the minimum required set

Patch Information

Oracle addressed CVE-2026-60811 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for all affected Supply Chain Trading Connector versions between 12.2.3 and 12.2.15.

Workarounds

If immediate patching is not feasible, block external HTTP access to the Supply Chain Trading Connector module at the reverse proxy or web application firewall
Disable unused Collaboration History functions and remove trading partner accounts that are not actively required
Increase audit logging verbosity on the affected module until the patch is deployed

bash

# Example: restrict access to the Supply Chain Trading Connector context at the Oracle HTTP Server layer
# Place inside the appropriate Location block in the EBS mod_wl_ohs configuration
<Location /ota>
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Location>