CVE-2026-60891: Oracle Work in Process Info Disclosure Flaw

CVE-2026-60891 Overview

CVE-2026-60891 affects the Oracle Work in Process product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. Exploitation requires a high-privileged attacker with local logon access to the infrastructure where Oracle Work in Process executes. Successful exploitation results in unauthorized read access to a subset of Oracle Work in Process data.

The vulnerability is classified as an information disclosure issue with confidentiality-only impact. No integrity or availability impact is reported, and no public exploit is currently available.

Critical Impact
A high-privileged local attacker can gain unauthorized read access to a subset of Oracle Work in Process accessible data.

Affected Products

Oracle E-Business Suite — Oracle Work in Process 12.2.3
Oracle E-Business Suite — Oracle Work in Process versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Work in Process 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60891 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60891

Vulnerability Analysis

CVE-2026-60891 is an information disclosure vulnerability in the Internal Operations component of Oracle Work in Process. The flaw allows an attacker who already holds high privileges and local logon access to the host running Oracle Work in Process to read a subset of data that should not be accessible to them.

The vulnerability does not permit modification of data, disruption of service, or lateral movement to other components. The impact is scoped to confidentiality, and the attack complexity is rated high, indicating exploitation depends on conditions outside the attacker's direct control.

Oracle has not published detailed root cause information. The Oracle Security Alert July 2026 is the authoritative reference and contains the patch matrix for affected E-Business Suite versions.

Root Cause

Oracle has not disclosed the underlying code-level defect. Based on the advisory, the issue resides in the Internal Operations component of Oracle Work in Process and permits unauthorized read access under specific conditions. Consult the vendor advisory for authoritative technical details.

Attack Vector

The attack vector is local. An attacker must authenticate to the infrastructure hosting Oracle Work in Process with high privileges before attempting exploitation. Network-based exploitation is not possible. User interaction is not required, and the scope remains unchanged.

No public proof-of-concept code exists for CVE-2026-60891. Refer to the vendor advisory for exploitation prerequisites and mitigation guidance.

Detection Methods for CVE-2026-60891

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-60891.
Unexpected local logons by privileged accounts to hosts running Oracle Work in Process warrant review.
Anomalous read queries or file access patterns against Work in Process data stores should be investigated.

Detection Strategies

Enable Oracle E-Business Suite audit logging for the Work in Process module and forward events to a centralized log platform.
Baseline expected privileged account activity on Oracle E-Business Suite hosts and alert on deviations.
Correlate operating system authentication events with database and application-tier access to identify unauthorized privileged access.

Monitoring Recommendations

Monitor interactive and remote logon sessions for accounts with administrative access to E-Business Suite hosts.
Track queries against Work in Process schemas and flag access outside documented business processes.
Review Oracle Fine-Grained Auditing (FGA) policies to ensure sensitive Work in Process tables are covered.

How to Mitigate CVE-2026-60891

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite versions 12.2.3 through 12.2.15.
Restrict local logon rights on Oracle E-Business Suite hosts to a minimal set of administrators.
Review privileged account inventories and revoke unnecessary high-privilege accounts on affected hosts.

Patch Information

Oracle addressed CVE-2026-60891 in the July 2026 Critical Patch Update. See the Oracle Security Alert July 2026 for the patch matrix and installation instructions specific to each supported version between 12.2.3 and 12.2.15.

Workarounds

No vendor-supplied workaround is documented; patching remains the authoritative remediation.
Enforce least privilege on operating system and database accounts to reduce the population of users who meet the high-privilege prerequisite.
Segment Oracle E-Business Suite infrastructure so that only jump hosts and authorized administrators can reach the application tier locally.

bash

# Review local logon rights on the Oracle E-Business Suite host (Linux example)
getent group wheel
last -a | head -n 50
sudo grep -E 'session opened|Accepted' /var/log/secure | tail -n 100