CVE-2026-60848: Oracle Project Contracts Auth Bypass Flaw

CVE-2026-60848 Overview

CVE-2026-60848 affects the Oracle Project Contracts product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through Oracle Project Contracts.

Critical Impact
Authenticated network attackers can compromise confidentiality and integrity across all Oracle Project Contracts accessible data.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Project Contracts product
Internal Operations component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60848 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update / Security Alert

Technical Details for CVE-2026-60848

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Project Contracts, a module within Oracle E-Business Suite used for contract management and project accounting. An authenticated attacker holding only low-privilege credentials can send crafted HTTP requests to the application to reach vulnerable functionality. Successful exploitation grants the attacker unauthorized read access and the ability to create, modify, or delete records across data managed by Oracle Project Contracts.

The vulnerability impacts confidentiality and integrity but not availability. Because attack complexity is low and no user interaction is required, exploitation is straightforward once an attacker obtains valid session credentials for an E-Business Suite user. The EPSS probability stands at 0.392%, placing the CVE in the 31.7th percentile at time of publication.

Root Cause

Oracle has not publicly disclosed the underlying weakness class. Based on the impact profile and required privilege level, the flaw is consistent with a broken access control or authorization bypass condition within one or more Internal Operations HTTP endpoints. Authenticated requests appear to reach data operations without adequate authorization checks against the caller's assigned roles or contract scope.

Attack Vector

Exploitation occurs over the network via HTTP against an internet-reachable or intranet-reachable Oracle E-Business Suite instance. The attacker authenticates with any low-privileged account and then issues requests to the vulnerable Internal Operations endpoints. No user interaction from other users is required, and the attack scope remains unchanged. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.

No verified public exploit code is currently available. The vulnerability mechanism is described in prose because no validated proof-of-concept has been published.

Detection Methods for CVE-2026-60848

Indicators of Compromise

Unexpected create, update, or delete operations on Project Contracts records performed by low-privilege user accounts.
HTTP requests to Internal Operations endpoints originating from user sessions that historically only performed read operations.
Anomalous access patterns to Oracle Project Contracts data outside the user's assigned business unit or contract scope.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking, and forward the audit records to a centralized SIEM for correlation.
Baseline normal Project Contracts activity per user role, then alert on deviations in HTTP endpoint usage and data mutation volume.
Review Oracle FND audit tables for out-of-policy writes to PA_* and OKC_* schema objects associated with Project Contracts.

Monitoring Recommendations

Monitor web tier access logs for unusual POST or PUT traffic to Internal Operations URLs authenticated by low-privilege accounts.
Alert on repeated 200 OK responses to Project Contracts data-modification requests from a single session in short time windows.
Track failed and successful authentication events on E-Business Suite forms and OA Framework pages that expose Project Contracts functionality.

How to Mitigate CVE-2026-60848

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for E-Business Suite versions 12.2.3 through 12.2.15 without delay.
Inventory all Oracle E-Business Suite instances and confirm patch level for the Project Contracts module.
Restrict network access to E-Business Suite web tiers so that only authorized users and networks can reach Internal Operations endpoints.
Review recent Project Contracts audit records for signs of unauthorized data modification prior to patching.

Patch Information

Oracle addressed CVE-2026-60848 in the July 2026 Critical Patch Update. Administrators should download the applicable patchset for their E-Business Suite release from My Oracle Support and follow Oracle's documented pre-install, install, and post-install steps. Patch details and cross-references are listed in the Oracle Security Alert July 2026.

Workarounds

Remove or reduce responsibilities that grant access to the Project Contracts Internal Operations functions for accounts that do not require them.
Place the E-Business Suite web tier behind a reverse proxy or WAF and restrict access to Internal Operations paths by IP allowlist while patching is scheduled.
Enforce multi-factor authentication on all E-Business Suite user accounts to raise the cost of obtaining the low-privilege access required for exploitation.

bash

# Verify Oracle E-Business Suite patch level (run as applmgr on the apps tier)
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop -status
sqlplus apps/<pwd> @$AD_TOP/sql/adutconf.sql
# Confirm the July 2026 CPU patch number is listed in AD_BUGS