CVE-2026-60908: Oracle E-Business Suite Info Disclosure

CVE-2026-60908 Overview

CVE-2026-60908 is a network-exploitable vulnerability in the Oracle Installed Base product of Oracle E-Business Suite, specifically in the Create Item Instance component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with HTTP access can exploit the weakness without user interaction. Successful exploitation grants unauthorized read access to all data accessible to Oracle Installed Base and unauthorized update, insert, or delete access to a subset of that data.

Critical Impact
Authenticated attackers can extract confidential business data from Oracle Installed Base and modify records through crafted HTTP requests, undermining the integrity of asset lifecycle and service management data.

Affected Products

Oracle E-Business Suite – Oracle Installed Base 12.2.3
Oracle E-Business Suite – Oracle Installed Base versions 12.2.4 through 12.2.14
Oracle E-Business Suite – Oracle Installed Base 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60908 published to the National Vulnerability Database
2026-07-21 - Oracle Critical Patch Update advisory published (Oracle Security Alert July 2026)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60908

Vulnerability Analysis

The vulnerability resides in the Create Item Instance component of Oracle Installed Base, a module of Oracle E-Business Suite used to track deployed items across their lifecycle. An authenticated user with low privileges can issue crafted HTTP requests that bypass intended access boundaries on item instance data. The attack requires no user interaction and can be executed remotely over the network.

Successful exploitation exposes confidential Installed Base records and permits unauthorized write operations on a subset of records. Because Installed Base integrates with Service, Contracts, and Order Management, tampered instance data can propagate integrity issues into downstream business processes. Availability is not affected, but the combined confidentiality and integrity loss is significant for organizations relying on Installed Base as a system of record.

Root Cause

The defect is a broken access control condition in the Create Item Instance workflow. Server-side authorization does not correctly enforce the caller's data scope, allowing a low-privileged session to reference or manipulate item instance records outside its authorized boundary. Oracle has not publicly detailed the internal code path; see the Oracle Security Alert July 2026 for vendor-supplied information.

Attack Vector

The attack vector is HTTP against an internet- or intranet-reachable Oracle E-Business Suite instance. The attacker authenticates with any low-privileged Oracle E-Business Suite account and submits a crafted request to the Installed Base Create Item Instance endpoint. No client-side interaction, elevated role, or chained vulnerability is required.

No verified public exploit code is available at the time of publication. The vulnerability mechanism is described in prose because no vetted proof-of-concept has been released. See the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60908

Indicators of Compromise

Unexpected HTTP POST requests to Oracle Installed Base Create Item Instance endpoints originating from low-privileged accounts.
Anomalous INSERT, UPDATE, or DELETE activity in CSI_ITEM_INSTANCES and related Installed Base tables outside normal business workflows.
Bulk reads of Installed Base records by user accounts that historically do not query that module.
Application server access logs showing repeated calls to Installed Base APIs by the same session with varying item identifiers.

Detection Strategies

Correlate Oracle E-Business Suite application logs with database audit logs to identify sessions accessing Installed Base data outside their role scope.
Enable Oracle Fine-Grained Auditing (FGA) on CSI_* tables to record read and write access by low-privileged users.
Baseline normal Installed Base API call patterns per user role and alert on statistical deviations.
Deploy web application firewall rules that flag unauthenticated or low-privileged requests to Create Item Instance endpoints.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized SIEM for cross-source correlation.
Monitor account privilege changes and role assignments in Oracle E-Business Suite for signs of preparatory privilege staging.
Track outbound data transfer volumes from database and application servers hosting Oracle Installed Base.

How to Mitigate CVE-2026-60908

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update of July 2026 to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle E-Business Suite instances exposed to untrusted networks and prioritize their patching.
Audit Oracle E-Business Suite user accounts and revoke unused or dormant low-privileged accounts that could be leveraged for exploitation.
Review recent Installed Base activity for signs of unauthorized read or write operations prior to patch application.

Patch Information

Oracle addressed CVE-2026-60908 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the specific patch identifiers applicable to their Oracle E-Business Suite 12.2 release level and apply them through standard AD (Applications DBA) patching procedures.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so that only trusted corporate networks or VPN clients can reach them.
Enforce least-privilege responsibility assignments and remove Installed Base responsibilities from users who do not require them.
Place a reverse proxy or web application firewall in front of Oracle E-Business Suite to log and rate-limit requests to Installed Base URLs until patches are applied.

bash

# Example: restrict inbound access to Oracle E-Business Suite HTTP listener
# Replace 10.0.0.0/8 with your trusted management network
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP