CVE-2026-60880: Oracle Work in Process RCE Vulnerability

CVE-2026-60880 Overview

CVE-2026-60880 affects the Oracle Work in Process product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation results in full takeover of Oracle Work in Process, compromising confidentiality, integrity, and availability.

Critical Impact
Remote unauthenticated attackers can take over Oracle Work in Process over HTTP, gaining full control of manufacturing workflow data and operations.

Affected Products

Oracle E-Business Suite - Oracle Work in Process 12.2.3
Oracle E-Business Suite - Oracle Work in Process versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Work in Process 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60880 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addressed the issue in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60880

Vulnerability Analysis

CVE-2026-60880 resides in the Internal Operations component of Oracle Work in Process, a manufacturing execution module in Oracle E-Business Suite. The vulnerability is remotely exploitable over HTTP and requires no authentication or user interaction. An attacker sending crafted requests to an exposed instance can take over the application. Because Work in Process manages shop-floor production data, work orders, material issue, and cost accumulation, a compromise disrupts manufacturing operations and exposes sensitive business data.

Oracle's advisory classifies the impact across confidentiality, integrity, and availability, indicating the attacker can read, modify, and destroy data or terminate the service. The attack surface spans HTTP-facing E-Business Suite deployments, which are frequently reachable from corporate networks or, in some configurations, the internet. The EPSS score of 0.384% (percentile 30.9) indicates modeled exploitation likelihood remains modest at publication time, but the low attack complexity increases risk as details emerge.

Root Cause

Oracle has not publicly disclosed the specific defect class. The advisory characterizes the flaw as an easily exploitable vulnerability in the Internal Operations component reachable via HTTP. Based on Oracle's phrasing ("takeover" with full CIA impact and no privileges required), the defect is consistent with missing authentication or input validation on a network-exposed endpoint. Consult the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical details.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted requests to the Oracle Work in Process HTTP interface exposed by Oracle E-Business Suite. No credentials, tokens, or victim interaction are required. Successful exploitation yields control over Oracle Work in Process, allowing the attacker to manipulate manufacturing records, exfiltrate data, or disrupt operations.

No public proof-of-concept, exploit code, or CISA KEV listing is available at publication. Administrators should treat the vulnerability as high priority regardless, given the pre-authentication network reachability.

Detection Methods for CVE-2026-60880

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite endpoints associated with the Work in Process (WIP) module, particularly from external or non-application-tier source IPs.
New or modified rows in Work in Process tables (for example, WIP_ENTITIES, WIP_DISCRETE_JOBS) that do not correlate with legitimate user or batch activity.
Creation of unexpected concurrent requests, database sessions, or OS-level processes under the E-Business Suite application account (for example, applmgr).

Detection Strategies

Enable and review Oracle HTTP Server access logs for anomalous request patterns targeting /OA_HTML/ paths and Work in Process servlets.
Correlate application-tier authentication events with database audit records to identify requests reaching backend logic without a valid signed-in user context.
Deploy web application firewall (WAF) rules to log and alert on unauthenticated POST requests to Work in Process URIs.

Monitoring Recommendations

Forward Oracle HTTP Server, concurrent manager, and database audit logs to a centralized SIEM for correlation and retention.
Baseline normal Work in Process transaction volumes per hour and alert on statistical deviations that could indicate automated abuse.
Monitor egress traffic from the E-Business Suite application tier for outbound connections to unknown hosts, which may indicate post-exploitation activity.

How to Mitigate CVE-2026-60880

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running Work in Process versions 12.2.3 through 12.2.15.
Inventory internet-exposed E-Business Suite deployments and restrict access to the Work in Process module until patching is complete.
Review Oracle HTTP Server and database logs for the past 30 days to identify pre-patch exploitation attempts.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, prerequisites, and application instructions specific to your E-Business Suite release. Apply patches in a non-production environment first, then roll out to production following Oracle's documented procedures for AD (Applications DBA) and AutoConfig.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or WAF that enforces authentication and blocks direct access to Work in Process endpoints from untrusted networks.
Restrict inbound HTTP access to the E-Business Suite application tier using network ACLs or firewall rules, limiting connectivity to trusted client subnets and VPN ranges.
Disable or unregister unused Work in Process HTTP servlets and forms functions if they are not required by business operations.

bash

# Example: restrict inbound HTTP to EBS application tier using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Verify the patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_BUG_ID_FROM_ORACLE_ADVISORY>');
EOF