CVE-2026-60824: Oracle iSupport Auth Bypass Vulnerability

CVE-2026-60824 Overview

CVE-2026-60824 is a high-severity information disclosure vulnerability in the Oracle iSupport product of Oracle E-Business Suite, specifically in the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability to gain unauthorized access to critical data accessible through Oracle iSupport. The vulnerability carries a scope change, meaning successful exploitation may impact resources beyond the vulnerable component. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker with low privileges can remotely access confidential data across Oracle iSupport and adjacent components without user interaction.

Affected Products

Oracle E-Business Suite — Oracle iSupport version 12.2.3
Oracle E-Business Suite — Oracle iSupport versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle iSupport version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60824 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix as part of the Oracle Security Alert CPU July 2026

Technical Details for CVE-2026-60824

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle iSupport, an Oracle E-Business Suite module that provides self-service support portals to customers and partners. An attacker authenticated with low privileges can send crafted HTTP requests to interact with functionality that fails to enforce proper authorization on sensitive data. Because the attack causes a scope change, exploitation can affect resources outside the security scope of Oracle iSupport itself. The impact is limited to confidentiality — integrity and availability of the target remain unaffected. Given the low attack complexity and network-based reachability, the vulnerability is well-suited to opportunistic exploitation of internet-facing E-Business Suite deployments.

Root Cause

The root cause is improper access control within the Internal Operations component, allowing a low-privileged authenticated user to reach data that should be restricted to higher-privileged roles. The scope-changing nature indicates that authorization boundaries between iSupport and related E-Business Suite components are not consistently enforced. This class of issue is typically categorized as Broken Access Control.

Attack Vector

Exploitation requires network access to the Oracle iSupport HTTP interface and a valid low-privileged account. The attacker issues crafted HTTP requests to Internal Operations endpoints that return or expose data belonging to other users, tenants, or adjacent E-Business Suite components. No user interaction is required. Public proof-of-concept code is not available at the time of writing.

No verified exploit code is publicly available. Refer to the Oracle Security Alert CPU July 2026 for vendor-authoritative technical details.

Detection Methods for CVE-2026-60824

Indicators of Compromise

Unexpected HTTP requests from low-privileged iSupport accounts targeting Internal Operations URLs such as those under /OA_HTML/ associated with iSupport modules.
Anomalous volume of successful HTTP 200 responses returning sensitive record types to non-administrative user sessions.
Access log entries showing a single authenticated session enumerating identifiers or record IDs across iSupport endpoints.

Detection Strategies

Baseline normal iSupport user behavior and alert on deviations, particularly enumeration patterns against Internal Operations endpoints.
Correlate Oracle E-Business Suite application logs with web tier access logs to identify low-privilege sessions retrieving data typically restricted to internal operators.
Review Oracle FND audit tables for unusual read activity by non-privileged responsibilities.

Monitoring Recommendations

Enable and forward Oracle E-Business Suite application, database, and Apache/OHS access logs to a centralized analytics platform for retention and correlation.
Monitor authentication events for low-privileged iSupport accounts exhibiting scripted or high-frequency request patterns.
Alert on unauthorized access to sensitive tables and API endpoints exposed through the Internal Operations component.

How to Mitigate CVE-2026-60824

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running Oracle iSupport versions 12.2.3 through 12.2.15.
Inventory internet-exposed iSupport instances and prioritize patching for those reachable from untrusted networks.
Audit iSupport user accounts and revoke unnecessary responsibilities that grant access to Internal Operations functionality.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert CPU July 2026 and apply the corresponding EBS patchset for their environment.

Workarounds

Restrict network access to Oracle iSupport HTTP endpoints using a web application firewall or reverse proxy allowlist until patches are applied.
Temporarily disable or reduce access to the Internal Operations component for low-privileged responsibilities where feasible.
Enforce strong authentication and session controls on all iSupport accounts to reduce the pool of usable low-privileged credentials.

bash

# Example: restrict access to iSupport endpoints at the reverse proxy
# (Apache HTTP Server configuration snippet)
<Location "/OA_HTML/ibuHome.jsp">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>