CVE-2026-60871: Oracle Risk Management Auth Bypass Flaw

CVE-2026-60871 Overview

CVE-2026-60871 is a high-severity vulnerability in the Oracle Risk Management product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An attacker with low privileges and network access over HTTP can exploit the weakness to compromise Oracle Risk Management. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible through Oracle Risk Management. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
A low-privileged, authenticated attacker with HTTP access can read, modify, or delete all data accessible to Oracle Risk Management across E-Business Suite versions 12.2.3 through 12.2.15.

Affected Products

Oracle E-Business Suite — Oracle Risk Management 12.2.3 through 12.2.15
Internal Operations component of Oracle Risk Management
Any integrated E-Business Suite deployments exposing the affected HTTP endpoints

Discovery Timeline

2026-07-21 - CVE CVE-2026-60871 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Fix released in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-60871

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Risk Management, a module of Oracle E-Business Suite. The CVSS impact profile shows High confidentiality and High integrity impact with no availability impact, indicating a broken access control or authorization flaw rather than a memory corruption issue. An authenticated attacker with only low privileges can send crafted HTTP requests to reach functionality that should require higher entitlement. The attack is described as easily exploitable and does not require user interaction. Successful exploitation grants complete read access and unauthorized create, delete, or modify access to all Oracle Risk Management data. The EPSS probability is 0.392% with a percentile ranking of 31.7 at the time of publication.

Root Cause

Oracle has not published root-cause details beyond the advisory summary. The impact pattern — full data read plus full data write from a low-privileged HTTP-authenticated session — is consistent with insufficient authorization enforcement (Broken Access Control) on Internal Operations endpoints. Refer to the Oracle Critical Patch Update Advisory for the authoritative fix description.

Attack Vector

The attack vector is network-based over HTTP against the E-Business Suite front end. The attacker must hold a valid low-privileged application account. From that session, the attacker issues requests to affected Risk Management Internal Operations endpoints to perform actions beyond their assigned role. No social engineering or client-side interaction is required, which increases the risk in environments where E-Business Suite is reachable from a broad internal user population or exposed to the internet.

No verified public proof-of-concept code is available at the time of writing. See the Oracle Critical Patch Update Advisory for technical remediation details.

Detection Methods for CVE-2026-60871

Indicators of Compromise

HTTP requests to Oracle Risk Management Internal Operations endpoints originating from user accounts that do not normally interact with that module.
Unexpected create, update, or delete operations against Risk Management records outside of standard business workflows.
Application audit log entries showing privilege-relevant actions performed by low-privileged E-Business Suite users.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for the Risk Management responsibilities.
Baseline normal user-to-module access patterns and alert on deviations targeting Internal Operations URLs.
Correlate application-tier logs with database audit logs to identify Risk Management data changes not attributable to authorized workflows.

Monitoring Recommendations

Forward E-Business Suite application, Oracle HTTP Server, and database audit logs to a central SIEM or data lake for retention and correlation.
Monitor for spikes in HTTP 200 responses to Risk Management endpoints from accounts recently granted minimal privileges.
Track configuration and data changes to Risk Management tables and alert on modifications performed outside change windows.

How to Mitigate CVE-2026-60871

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Risk Management versions 12.2.3 through 12.2.15.
Inventory all low-privileged application accounts and validate that responsibilities and role grants follow least privilege.
Restrict network reachability of the E-Business Suite front end to trusted network segments and VPN users where feasible.
Rotate credentials for any accounts suspected of misuse and review recent Risk Management data changes for tampering.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update Advisory for the exact patch identifiers applicable to their E-Business Suite 12.2.x release and follow Oracle's documented application procedure, including any prerequisite technology stack patches.

Workarounds

No vendor-provided workaround has been published; patching is the supported remediation path.
As a compensating control, remove Risk Management responsibilities from users who do not require access until patches are applied.
Place a web application firewall or reverse proxy in front of E-Business Suite to log and constrain access to Internal Operations URLs.
Increase audit log retention and review frequency for the Risk Management module until remediation is confirmed.

bash

# Verify current Oracle E-Business Suite patch level before and after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF