CVE-2026-60886: Oracle Work in Process Auth Bypass Flaw

CVE-2026-60886 Overview

CVE-2026-60886 affects the Oracle Work in Process product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability, provided they can convince a separate user to perform an action. The issue produces a scope change under CVSS, meaning exploitation can affect components beyond Oracle Work in Process itself.

Critical Impact
Successful exploitation grants unauthorized access to all Oracle Work in Process accessible data and allows unauthorized update, insert, or delete on a subset of that data.

Affected Products

Oracle E-Business Suite — Oracle Work in Process 12.2.3
Oracle E-Business Suite — Oracle Work in Process versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Work in Process 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60886 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Advisory July 2026

Technical Details for CVE-2026-60886

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Work in Process, a manufacturing execution module within Oracle E-Business Suite. An authenticated attacker holding low-privilege credentials can send crafted HTTP requests to the module. Exploitation additionally requires user interaction from a party other than the attacker, typically an authenticated user who triggers the malicious content through a browser session.

Because the vulnerability produces a scope change, attacker actions initiated in Oracle Work in Process can extend impact into other Oracle E-Business Suite components sharing the authenticated session context. The confidentiality impact is rated high, allowing full read access to Oracle Work in Process data, while integrity impact is limited to partial write access. Availability is not affected.

The requirement for user interaction and the scope change strongly suggest a client-side injection pattern, consistent with Cross-Site Scripting (XSS) or a related content-injection weakness delivered through the web tier of Oracle E-Business Suite.

Root Cause

Oracle has not published detailed root-cause information beyond the Critical Patch Update advisory. The CVSS profile — network attack vector, low privileges, required user interaction, and scope change — is consistent with insufficient output encoding or input validation in HTTP-facing pages served by the Internal Operations component. Refer to the Oracle Security Advisory July 2026 for vendor-supplied technical detail.

Attack Vector

An attacker authenticates to Oracle E-Business Suite with a low-privileged account and submits crafted input through an HTTP-accessible Work in Process interface. When a second, typically higher-privileged user interacts with the affected page or workflow, the attacker's payload executes in that user's session context. The scope change then permits the attacker to reach data and functionality outside of Oracle Work in Process.

No verified public exploit code is available for CVE-2026-60886. The EPSS probability is 0.268% (percentile 18.689) as of 2026-07-23, indicating low near-term exploitation likelihood.

Detection Methods for CVE-2026-60886

Indicators of Compromise

Unexpected HTTP POST or GET parameters containing HTML, JavaScript, or event-handler payloads submitted to Oracle Work in Process URLs.
Session activity where a low-privileged Oracle E-Business Suite account is followed by anomalous privileged actions from a different user session within a short window.
Outbound HTTP requests from Oracle E-Business Suite users' browsers to unrecognized external hosts immediately after loading a Work in Process page.

Detection Strategies

Inspect Oracle HTTP Server and WebLogic access logs for request parameters targeting Internal Operations endpoints that contain script tags, encoded angle brackets, or javascript: schemes.
Correlate Oracle E-Business Suite audit records with web-tier logs to surface cases where low-privileged input precedes higher-privileged data reads or writes.
Deploy web application firewall rules that flag reflected or stored content-injection patterns on Oracle E-Business Suite URLs.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Work in Process responsibility.
Forward Oracle HTTP Server, WebLogic, and database audit logs to a centralized SIEM for retention and correlation.
Alert on abnormal cross-module data access originating from Work in Process sessions, since the scope change enables lateral impact.

How to Mitigate CVE-2026-60886

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory user accounts holding the Work in Process responsibility and revoke access that is not operationally required.
Restrict network exposure of Oracle E-Business Suite web tiers to trusted internal networks or authenticated VPN paths.

Patch Information

Oracle addressed CVE-2026-60886 in the July 2026 Critical Patch Update. Administrators should download the relevant patch through My Oracle Support, review the readme for prerequisite bundles on Oracle E-Business Suite 12.2, and apply the update in a test environment before production rollout. The advisory is available at the Oracle Security Advisory July 2026.

Workarounds

Reduce assignment of the Work in Process responsibility to the minimum set of business users until patching completes.
Enforce browser-based session isolation and require re-authentication for privileged Oracle E-Business Suite responsibilities.
Place a web application firewall in front of the Oracle E-Business Suite web tier with rules that block script and event-handler injection in HTTP parameters.

bash

# Example: enable Page Access Tracking and Sign-On Audit for the Work in Process responsibility
# (perform via System Administrator responsibility in Oracle E-Business Suite)
# 1. Set profile option: Sign-On:Audit Level = FORM
# 2. Set profile option: FND: Page Access Tracking = ENABLED (site or responsibility level)
# 3. Restart Oracle E-Business Suite services to apply
$ADMIN_SCRIPTS_HOME/adstpall.sh apps/<apps_password>
$ADMIN_SCRIPTS_HOME/adstrtal.sh apps/<apps_password>