CVE-2026-60859: Oracle Quoting Auth Bypass Vulnerability

CVE-2026-60859 Overview

CVE-2026-60859 affects the Oracle Quoting product within Oracle E-Business Suite, specifically the Internal Operations component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the flaw, although exploitation is rated as difficult. Successful exploitation can result in full takeover of Oracle Quoting, compromising confidentiality, integrity, and availability.

Oracle disclosed the issue in the July 2026 Critical Patch Update. No public proof-of-concept exploit or evidence of exploitation in the wild has been reported at this time.

Critical Impact
Successful exploitation grants an authenticated attacker full takeover of Oracle Quoting, exposing sensitive quoting data and enabling unauthorized modification or disruption of business operations.

Affected Products

Oracle E-Business Suite — Oracle Quoting 12.2.3
Oracle E-Business Suite — Oracle Quoting versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Quoting 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60859 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database

Technical Details for CVE-2026-60859

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Quoting, a module within Oracle E-Business Suite used to create and manage customer quotes. Attackers can reach the vulnerable functionality over HTTP, meaning any authenticated user with low privileges and network access to the application can attempt exploitation.

A successful attack yields full takeover of the Oracle Quoting product. This includes read access to quoting data, the ability to modify records, and the ability to disrupt service availability. Because Oracle Quoting integrates with order management and pricing subsystems, downstream business processes are exposed to further impact.

Exploitation requires meeting specific preconditions that raise attack complexity, but authentication requirements are minimal. Environments that expose the E-Business Suite front end to broad user populations, including partner or extranet deployments, face the greatest risk.

Root Cause

Oracle has not published root-cause details in the public advisory. The July 2026 Critical Patch Update advisory documents impact and affected versions without disclosing the underlying weakness class or CWE mapping.

Attack Vector

The attack originates over the network via HTTP against the Oracle Quoting application. The attacker must hold valid low-privilege credentials to the E-Business Suite instance. No end-user interaction is required, and the attack scope is unchanged from the vulnerable component.

Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60859

Indicators of Compromise

Unexpected changes to quote records, pricing entries, or approval statuses in Oracle Quoting tables that do not correspond to legitimate user activity.
Authentication events from low-privilege E-Business Suite accounts followed by administrative actions inside the Quoting module.
Anomalous HTTP POST or GET traffic patterns targeting Oracle Quoting Internal Operations endpoints.

Detection Strategies

Enable Oracle E-Business Suite auditing (FND_LOG_MESSAGES, sign-on audit) on the Quoting responsibility and review privileged action logs.
Correlate application server access logs with database audit trails to identify sessions that trigger high volumes of Quoting API calls from a single low-privilege account.
Baseline normal Quoting workflows and alert on deviations such as off-hours activity, geographic anomalies, or bursts of quote modifications.

Monitoring Recommendations

Forward E-Business Suite application, middle-tier, and database logs to a centralized platform for cross-tier correlation and long-term retention.
Monitor egress from the E-Business Suite application tier for unexpected outbound connections that could indicate data staging or exfiltration.
Track patch state of every 12.2.x middle-tier node so that unpatched hosts are flagged for accelerated remediation.

How to Mitigate CVE-2026-60859

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle E-Business Suite to every 12.2.3 through 12.2.15 environment.
Inventory all Oracle Quoting deployments, including test and disaster-recovery instances, and prioritize internet-exposed systems.
Review and reduce user assignments to the Quoting responsibility, removing accounts that do not require access.
Rotate credentials for any low-privilege accounts that may have been exposed prior to patching.

Patch Information

Oracle addressed CVE-2026-60859 in the July 2026 Critical Patch Update. Administrators should download the applicable patch from My Oracle Support and follow the readme instructions for their specific 12.2.x baseline. See the Oracle Security Alert July 2026 for patch identifiers and installation prerequisites.

Workarounds

Restrict network access to Oracle Quoting endpoints using a web application firewall or reverse proxy allow-list until patching completes.
Disable or limit the Quoting responsibility for accounts that do not require it, reducing the pool of usable low-privilege credentials.
Enforce multi-factor authentication on all E-Business Suite accounts to raise the cost of credential-based access.

bash

# Configuration example: restrict Quoting endpoints at the reverse proxy
# Example nginx snippet limiting access by source network
location /OA_HTML/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://ebs-app-tier;
}