CVE-2026-60852: Oracle Lease Management Auth Bypass Flaw

CVE-2026-60852 Overview

CVE-2026-60852 is a high-severity vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite, within the Internal Operations component. Affected releases span versions 12.2.3 through 12.2.15. The flaw allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to all data accessible by Oracle Lease and Finance Management. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker over HTTP can read and modify all data accessible to Oracle Lease and Finance Management, resulting in a full breach of confidentiality and integrity for the module.

Affected Products

Oracle E-Business Suite — Oracle Lease and Finance Management 12.2.3
Oracle E-Business Suite — Oracle Lease and Finance Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Lease and Finance Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60852 published to NVD
2026-07-21 - Last updated in NVD database
Referenced in the Oracle Security Alert—July 2026

Technical Details for CVE-2026-60852

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Lease and Finance Management, a module of Oracle E-Business Suite. Oracle's advisory classifies exploitation as easy and confirms it requires network access over HTTP. An attacker only needs low-level application privileges to trigger the issue, meaning any authenticated E-Business Suite user with routine access to the module can attempt exploitation. No user interaction is required, and the scope remains unchanged, indicating the impact is confined to the vulnerable component.

Successful exploitation grants full read and write access to data managed by Oracle Lease and Finance Management. This includes lease contracts, financial terms, payment schedules, and internal accounting records. Availability is not affected, so exploitation is likely to be stealthy and focused on data theft or fraudulent record manipulation rather than service disruption. The EPSS score of 0.298% reflects a low current probability of observed exploitation, but the low attack complexity raises long-term risk once technical details circulate.

Root Cause

Oracle has not published the underlying flaw class in its public alert. Based on the CVSS profile — network vector, low complexity, low privileges, high confidentiality and integrity impact, no availability impact — the defect is consistent with a broken access control or input validation weakness in an HTTP-facing servlet or business-logic endpoint. The condition permits an authenticated low-privilege user to reach and act on data or operations reserved for higher-privileged roles.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle E-Business Suite web tier. The attacker authenticates with a low-privileged E-Business Suite account and issues crafted requests to the Internal Operations endpoints of the Lease and Finance Management module. Because privileges required are low and no user interaction is needed, insider threats, compromised employee accounts, and credential-stuffing outcomes are the most plausible exploitation paths. Refer to the Oracle Security Alert—July 2026 for technical remediation details.

Detection Methods for CVE-2026-60852

Indicators of Compromise

Unexpected create, update, or delete operations against Lease and Finance Management tables performed by low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user sessions that do not normally interact with that module.
Bulk read access patterns against lease contract, payment, and financial-term records outside of documented batch jobs.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record which users invoke Lease and Finance Management pages and functions.
Correlate application audit trail entries with database-level auditing on OKL_% and related Lease and Finance Management schemas to identify privilege mismatches.
Alert on any HTTP POST or PUT requests to Internal Operations URLs by accounts lacking the corresponding responsibilities.

Monitoring Recommendations

Baseline normal responsibility-to-URL mappings for the Lease and Finance Management module and alert on deviations.
Forward E-Business Suite application, Oracle HTTP Server, and database audit logs to a centralized SIEM for cross-tier correlation.
Review privileged and low-privileged account activity in the module daily until the July 2026 CPU patches are fully deployed.

How to Mitigate CVE-2026-60852

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all affected environments, prioritizing internet-exposed instances.
Inventory all Lease and Finance Management deployments running versions 12.2.3 through 12.2.15 and confirm patch status.
Rotate credentials and review recent activity for any account with access to the Lease and Finance Management module.

Patch Information

Oracle addressed CVE-2026-60852 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert—July 2026 for each affected 12.2.x release. Follow Oracle's documented E-Business Suite patching procedure, including running adop in the appropriate patch cycle and validating the environment after cutover.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers to trusted corporate networks and VPN ranges until patches are applied.
Remove or reduce Lease and Finance Management responsibilities from accounts that do not require them, minimizing the pool of exploitable low-privileged users.
Enforce strong authentication, including multi-factor authentication, on all E-Business Suite accounts to reduce the risk of credential-based exploitation.

bash

# Example: apply the July 2026 CPU patch using adop in Oracle E-Business Suite 12.2
# Run as the applmgr user on the run file system
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop phase=prepare
adop phase=apply patches=<JUL2026_CPU_PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup