CVE-2026-60907: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60907 Overview

CVE-2026-60907 affects the Oracle Installed Base product within Oracle E-Business Suite, specifically the Create Item Instance component. Supported versions 12.2.4 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires overcoming significant complexity.

Successful attacks allow unauthorized update, insert, or delete access to a subset of Oracle Installed Base data. Attackers can also achieve unauthorized read access to certain records and cause a partial denial of service against the component.

Critical Impact
Authenticated attackers can tamper with Oracle Installed Base records, read a subset of data, and induce partial service disruption over the network.

Affected Products

Oracle E-Business Suite - Oracle Installed Base, version 12.2.4
Oracle E-Business Suite - Oracle Installed Base, versions 12.2.5 through 12.2.14
Oracle E-Business Suite - Oracle Installed Base, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60907 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Included in Oracle Security Alert July 2026

Technical Details for CVE-2026-60907

Vulnerability Analysis

The vulnerability resides in the Create Item Instance component of Oracle Installed Base, a module used to track installed products and configurations across the Oracle E-Business Suite. The flaw permits an authenticated user with low privileges to manipulate data flows tied to item instance creation over HTTP.

Successful exploitation produces three distinct impacts. Attackers gain unauthorized write access allowing updates, inserts, or deletes against a subset of Installed Base data. They also gain unauthorized read access to a limited data subset and can trigger a partial denial of service against the component.

The attack complexity is high, meaning the attacker must satisfy conditions outside their direct control to reliably exploit the flaw. Oracle has not disclosed the specific weakness class, and no public proof-of-concept exploit is available.

Root Cause

Oracle has not published a detailed root cause analysis. The Create Item Instance workflow appears to permit operations beyond the authorization boundary intended for low-privileged users. Consult the Oracle Security Alert July 2026 for authoritative technical details.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires valid low-privileged credentials on the Oracle E-Business Suite instance. No user interaction is required. The scope is unchanged, meaning the impact stays within the vulnerable component's security authority.

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.214%, indicating a low probability of exploitation in the near term.

Detection Methods for CVE-2026-60907

Indicators of Compromise

Unexpected creation, modification, or deletion of item instance records in Oracle Installed Base tables such as CSI_ITEM_INSTANCES
HTTP requests to Installed Base Create Item Instance endpoints originating from low-privileged accounts outside their normal operational scope
Unexplained partial availability degradation of Oracle Installed Base services

Detection Strategies

Audit Oracle E-Business Suite application logs and database audit trails for anomalous access patterns against Installed Base objects
Correlate authenticated session activity with changes to Installed Base data to identify privilege boundary violations
Baseline normal Create Item Instance transaction volume per user role and alert on deviations

Monitoring Recommendations

Enable Oracle Fine-Grained Auditing (FGA) on Installed Base tables to capture read and write activity attributable to individual sessions
Forward Oracle E-Business Suite and database audit logs to a centralized analytics platform for cross-source correlation
Monitor HTTP access logs for repeated requests to Installed Base servlets from accounts with limited business justification

How to Mitigate CVE-2026-60907

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite versions 12.2.4 through 12.2.15
Review and restrict Oracle Installed Base responsibilities and roles assigned to low-privileged users
Rotate credentials for accounts suspected of unauthorized activity against Installed Base components

Patch Information

Oracle addressed CVE-2026-60907 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patches referenced in the Oracle Security Alert July 2026 advisory. Test patches in a non-production environment before rolling out to production Oracle E-Business Suite instances.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted internal networks and VPN clients
Enforce least-privilege assignment of Installed Base responsibilities until patches are applied
Increase audit logging granularity on Installed Base transactions to shorten detection time for exploitation attempts

bash

# Configuration example
# Refer to the Oracle Security Alert July 2026 advisory for patch application steps
# https://www.oracle.com/security-alerts/cpujul2026.html