CVE-2026-60843: Oracle E-Business Suite Privilege Escalation

CVE-2026-60843 Overview

CVE-2026-60843 is a vulnerability in the Oracle Citizen Interaction Center product of Oracle E-Business Suite, affecting the Internal Operations component. The flaw allows a high-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in unauthorized creation, modification, or deletion of critical data, and unauthorized read access to all data accessible by Oracle Citizen Interaction Center. Oracle disclosed the issue in the July 2026 Critical Patch Update. Supported versions 12.2.3 through 12.2.15 are affected.

Critical Impact
Authenticated network attackers can read and modify all data accessible by Oracle Citizen Interaction Center, resulting in full confidentiality and integrity impact on the application.

Affected Products

Oracle E-Business Suite — Oracle Citizen Interaction Center 12.2.3
Oracle E-Business Suite — Oracle Citizen Interaction Center versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Citizen Interaction Center 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60843 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Fix included in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60843

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Citizen Interaction Center, a module within Oracle E-Business Suite. An attacker with high privileges can send crafted HTTP requests over the network to abuse functionality that lacks sufficient authorization or input controls. Successful exploitation grants attackers unauthorized read access to all data accessible by the application, plus the ability to create, modify, or delete critical data. Availability is not impacted, but both confidentiality and integrity of the application scope are fully compromised. The attack does not require user interaction and is described by Oracle as easily exploitable once the attacker holds valid privileged credentials.

Root Cause

Oracle has not published root-cause details. The advisory characterizes the issue as an easily exploitable flaw reachable through HTTP that permits privileged users to access and modify data beyond their intended scope. This behavior is consistent with a broken access control or authorization weakness in the Internal Operations component.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP endpoint and a valid, high-privileged account within Citizen Interaction Center. The attacker submits requests to Internal Operations endpoints to read or manipulate records belonging to other tenants, cases, or business objects. Because the EPSS score is 0.381%, the likelihood of near-term opportunistic exploitation is low, but the risk is elevated in environments where privileged EBS accounts are widely distributed or shared. No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been observed at the time of publication.

No verified exploit code is available. Refer to the Oracle Critical Patch Update advisory for the vendor's technical guidance.

Detection Methods for CVE-2026-60843

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Citizen Interaction Center Internal Operations endpoints originating from privileged accounts outside their usual working patterns.
Database audit records showing INSERT, UPDATE, or DELETE operations on Citizen Interaction Center tables performed by accounts that do not typically alter those objects.
Application logs showing large volumes of record retrievals or exports by a single privileged session.

Detection Strategies

Enable Oracle E-Business Suite sign-on audit and page access tracking, and forward events to a centralized log platform for correlation.
Baseline typical usage of Internal Operations forms per user role and alert on deviations in request volume, timing, or accessed record scope.
Correlate database-level auditing (FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, and object audit trails) with application-tier HTTP logs to reconstruct privileged sessions.

Monitoring Recommendations

Monitor authentication events for Citizen Interaction Center responsibilities and alert on new or dormant privileged accounts becoming active.
Track anomalous HTTP POST activity to /OA_HTML/ endpoints associated with Internal Operations functions.
Review changes to critical Citizen Interaction Center configuration and case data at defined intervals against a known-good state.

How to Mitigate CVE-2026-60843

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 instances running Citizen Interaction Center.
Inventory all accounts holding high-privilege responsibilities in Citizen Interaction Center and revoke access that is not strictly required.
Rotate credentials for privileged EBS accounts and enforce multi-factor authentication on all administrative access paths.

Patch Information

Oracle addressed CVE-2026-60843 in the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented patch application procedures for Oracle E-Business Suite 12.2 and validate the fix in a non-production environment before rolling out to production.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted internal networks and jump hosts can reach Citizen Interaction Center endpoints.
Reduce the population of users assigned high-privilege Citizen Interaction Center responsibilities until the CPU is applied.
Enable enhanced auditing on Internal Operations forms and associated database objects to shorten detection time if abuse occurs.

bash

# Example: enable sign-on audit at FORM level in Oracle E-Business Suite
# Set the profile option 'Sign-On:Audit Level' to FORM for the site
# via System Administrator responsibility, then bounce the middle tier:
adstpall.sh apps/<apps_password>
adstrtal.sh apps/<apps_password>