CVE-2026-60904: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60904 Overview

CVE-2026-60904 is a high-severity vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically within the Create Item Instance component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle Installed Base. Successful exploitation grants unauthorized creation, deletion, or modification access to critical data, along with unauthorized read access to all Oracle Installed Base accessible data.

Critical Impact
Authenticated remote attackers can read, modify, or delete all data accessible to Oracle Installed Base, breaking confidentiality and integrity of ERP records.

Affected Products

Oracle E-Business Suite — Oracle Installed Base 12.2.3
Oracle E-Business Suite — Oracle Installed Base versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Installed Base 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60904 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60904

Vulnerability Analysis

The vulnerability resides in the Create Item Instance component of Oracle Installed Base, a module of Oracle E-Business Suite used to track installed products and customer assets. An attacker who holds any valid low-privilege session can send crafted HTTP requests to the affected endpoint. The scope of impact covers both confidentiality and integrity of the entire Installed Base data set, not just the attacker's own records. Availability of the system is not affected, according to the CVSS vector published by Oracle.

Root Cause

Oracle has not publicly disclosed the underlying weakness class or CWE identifier for this issue. Based on the impact profile — cross-tenant data access and modification from a low-privileged HTTP session against a create-object endpoint — the root cause is consistent with broken access control or missing authorization checks on the Create Item Instance operation. Detailed technical specifics are restricted under Oracle's coordinated disclosure practice and are available only in the Oracle Critical Patch Update.

Attack Vector

Exploitation requires network access via HTTP and a valid authenticated account with low privileges. No user interaction is needed. The attacker targets the Create Item Instance interface exposed by Oracle Installed Base and issues requests that read or manipulate item instance records outside the attacker's authorized scope. Because Oracle E-Business Suite is frequently reachable from internal corporate networks and, in some deployments, from partner or internet-facing portals, the population of potential attackers can include contractors, partners, and any authenticated user of the ERP.

No verified proof-of-concept code is available. See the Oracle Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-60904

Indicators of Compromise

Unexpected creations, modifications, or deletions of CSI_ITEM_INSTANCES records or related Installed Base tables by low-privileged application users.
HTTP requests to Oracle Installed Base Create Item Instance endpoints originating from accounts that do not normally interact with the module.
Anomalous spikes in Installed Base API calls or Oracle Applications Framework (OAF) page invocations tied to item instance operations.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate user identity with Installed Base transactions.
Baseline typical Installed Base transaction volumes per role and alert on deviations, especially from accounts with low functional privileges.
Inspect Oracle HTTP Server and WebLogic access logs for repeated POST requests to Installed Base URLs from a single session or IP.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized SIEM for cross-source correlation.
Monitor database audit trails on Installed Base schema objects for direct DML activity that bypasses normal responsibility-based workflows.
Track patch inventory using Oracle OPatch and adop output to confirm the July 2026 CPU has been applied on every EBS environment.

How to Mitigate CVE-2026-60904

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments as the primary remediation.
Restrict network exposure of Oracle E-Business Suite to trusted networks and VPN users while patching is scheduled.
Review and reduce the population of accounts holding Installed Base responsibilities to enforce least privilege.

Patch Information

Oracle addressed CVE-2026-60904 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update advisory for the specific patch identifiers applicable to their EBS 12.2.x release level and apply them using the standard adop online patching workflow.

Workarounds

Remove or reassign Installed Base responsibilities from users who do not require Create Item Instance access until patching is complete.
Place a web application firewall or reverse proxy rule in front of Oracle E-Business Suite to restrict access to Installed Base URLs by source IP and authenticated role.
Increase auditing on Installed Base tables and monitor for out-of-policy changes as a compensating control.

bash

# Verify EBS patch level and confirm July 2026 CPU application
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_IDS>')
 ORDER BY last_update_date DESC;
EOF

# Apply patch using adop online patching (run as applmgr)
adop phase=prepare
adop phase=apply patches=<patch_number> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup