CVE-2026-60888: Oracle Work in Process Info Disclosure Bug

CVE-2026-60888 Overview

CVE-2026-60888 affects the Oracle Work in Process product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability, though exploitation is rated as difficult due to high attack complexity. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. The confidentiality impact is high, while integrity and availability are unaffected.

Critical Impact
Successful exploitation grants attackers unauthorized read access to sensitive manufacturing and operations data managed by Oracle Work in Process.

Affected Products

Oracle E-Business Suite — Oracle Work in Process 12.2.3
Oracle E-Business Suite — Oracle Work in Process 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Work in Process 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60888 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60888

Vulnerability Analysis

CVE-2026-60888 is an information disclosure vulnerability in the Internal Operations component of Oracle Work in Process. The affected component processes HTTP requests within the Oracle E-Business Suite application tier. An authenticated user with low privileges can leverage the flaw to read data outside the scope of their assigned authorization boundary.

Oracle Work in Process manages shop floor execution, job costing, and production tracking. Data accessible through this component typically includes bill-of-material references, work order details, resource assignments, and cost information. Unauthorized exposure of this data can facilitate supply chain reconnaissance and downstream attacks against manufacturing operations.

Exploitation requires the attacker to hold a valid low-privilege account within the E-Business Suite instance. The high attack complexity indicates that additional conditions beyond attacker control must be satisfied, such as specific application state or configuration prerequisites. There is no reported public exploit and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.297%.

Root Cause

Oracle has not published detailed root cause information. Based on the CVSS metrics and impact scope, the flaw permits authenticated requests to retrieve data beyond the requesting user's authorization context within the Internal Operations component. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied details.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker sends crafted requests to the Oracle Work in Process Internal Operations endpoints exposed by the E-Business Suite application server. No user interaction is required. Because scope is unchanged, the disclosed data is confined to resources reachable by the vulnerable component.

Detection Methods for CVE-2026-60888

Indicators of Compromise

Anomalous volumes of HTTP requests targeting Oracle Work in Process Internal Operations URLs from low-privileged accounts
Access patterns where a single session enumerates work order, job, or cost records outside the user's assigned organization
Application server access logs containing repeated requests with parameter fuzzing against Work in Process endpoints

Detection Strategies

Enable and centralize Oracle E-Business Suite application-tier access logs and correlate them with authentication events
Baseline normal Work in Process query volumes per user role and alert on statistical deviations
Monitor database audit trails for WIP schema reads originating from application accounts tied to unexpected end users

Monitoring Recommendations

Forward Oracle application server, database audit, and identity provider logs to a centralized analytics platform for cross-source correlation
Track privileged HTTP session activity against Internal Operations endpoints on a rolling window
Alert on Work in Process data retrieval outside of business hours or from atypical source networks

How to Mitigate CVE-2026-60888

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 instances
Inventory all Oracle Work in Process deployments and validate patch coverage across production, test, and disaster recovery environments
Review recent access logs for the Internal Operations component to identify potential prior exploitation attempts

Patch Information

Oracle addressed CVE-2026-60888 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Critical Patch Update July 2026 advisory. Oracle recommends applying the CPU patches without delay, as unsupported or unpatched versions remain exposed.

Workarounds

Restrict network access to Oracle E-Business Suite application tier endpoints using firewall or reverse proxy allowlists
Enforce least-privilege role assignments for Work in Process users to reduce the number of accounts eligible to exploit the flaw
Require multi-factor authentication for all E-Business Suite user accounts to raise the barrier to credential-based exploitation

bash

# Example: restrict HTTP access to E-Business Suite application tier
# Replace with your environment-specific addresses and ports
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP