CVE-2026-60842: Oracle Knowledge Management Auth Bypass

CVE-2026-60842 Overview

CVE-2026-60842 is a medium-severity vulnerability in the Search component of Oracle Knowledge Management, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.5 through 12.2.15. An unauthenticated remote attacker can exploit the issue over HTTP, but successful attacks require user interaction from a victim other than the attacker. The CVSS vector indicates a scope change, meaning exploitation can affect components beyond Oracle Knowledge Management itself. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some Oracle Knowledge Management data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Knowledge Management 12.2.5 through 12.2.15
Oracle E-Business Suite (Search component)
Deployments exposing Oracle Knowledge Management over HTTP

Discovery Timeline

2026-07-21 - CVE CVE-2026-60842 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle Critical Patch Update released addressing the issue

Technical Details for CVE-2026-60842

Vulnerability Analysis

The vulnerability resides in the Search component of Oracle Knowledge Management, a module within Oracle E-Business Suite used to store and retrieve enterprise knowledge base content. The attack vector is network-based over HTTP, and the attack complexity is low. No authentication is required, but the attacker must convince a legitimate user to interact with a crafted request or link. The scope change and user-interaction requirement, combined with low confidentiality and integrity impact, are consistent with a client-side injection flaw such as reflected cross-site scripting in the search functionality. The EPSS probability is approximately 0.238%, reflecting a low observed likelihood of exploitation in the near term.

Root Cause

Oracle has not published detailed root cause information. Based on the CVSS characteristics, the flaw likely stems from insufficient sanitization or encoding of user-controlled input rendered by the Search component. When an attacker-supplied payload is reflected back to a victim's browser, it executes in the security context of the Oracle Knowledge Management application, enabling data manipulation and read access on behalf of the victim.

Attack Vector

An unauthenticated attacker crafts a malicious HTTP request targeting the Search component and delivers it to an authenticated Oracle Knowledge Management user through phishing, embedded links, or other social engineering. When the victim interacts with the request, the payload executes within their session. Because the CVSS scope is changed, the injected code can affect resources outside the vulnerable component, such as other Oracle E-Business Suite modules accessible to the victim's session. The result is limited unauthorized reading, insertion, updating, or deletion of data.

No verified public proof-of-concept code exists for this issue. See the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-60842

Indicators of Compromise

Unexpected HTTP requests to Oracle Knowledge Management Search endpoints containing script tags, event handlers, or encoded JavaScript payloads.
Anomalous session activity where a single user account performs unexpected create, update, or delete operations shortly after clicking an external link.
Web server or reverse proxy logs showing long or heavily URL-encoded query strings targeting Knowledge Management search parameters.

Detection Strategies

Inspect application and web server access logs for suspicious query parameters submitted to the Search component.
Correlate authentication events with subsequent data modification actions to identify user-interaction driven exploitation.
Deploy web application firewall rules that flag reflected script patterns and encoded payloads targeting Oracle E-Business Suite URLs.

Monitoring Recommendations

Enable verbose HTTP logging on Oracle E-Business Suite front-end servers and forward logs to a centralized analytics platform for retention and query.
Monitor outbound network connections from user browsers to unknown domains immediately after Oracle E-Business Suite session activity.
Alert on Oracle Knowledge Management administrative actions performed outside change windows or by accounts with no prior history of such operations.

How to Mitigate CVE-2026-60842

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.5 through 12.2.15.
Inventory Oracle Knowledge Management deployments and confirm patch status against Oracle's advisory matrix.
Educate Oracle E-Business Suite users about phishing links referencing internal Knowledge Management URLs.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update July 2026 advisory for the specific patch identifiers applicable to each Oracle E-Business Suite release. Apply patches in a test environment first and validate Knowledge Management functionality before promoting to production.

Workarounds

Restrict network access to Oracle Knowledge Management interfaces so only trusted internal users and networks can reach the Search endpoints.
Deploy a web application firewall in front of Oracle E-Business Suite with rules that block reflected script injection patterns in query parameters.
Enforce strict Content Security Policy headers on Oracle E-Business Suite responses to limit execution of injected scripts until patches are applied.

bash

# Example WAF rule (ModSecurity) to block reflected script payloads on Knowledge Management search
SecRule REQUEST_URI "@contains /OA_HTML/" \
  "chain,phase:2,deny,status:403,id:1602026,\
   msg:'Possible XSS attempt against Oracle Knowledge Management Search (CVE-2026-60842)'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"