CVE-2026-60910: Oracle Property Manager Privilege Escalation

CVE-2026-60910 Overview

CVE-2026-60910 is a high-severity vulnerability in the Oracle Property Manager product of Oracle E-Business Suite, within the Internal Operations component. Affected versions span 12.2.3 through 12.2.15. The flaw allows a high-privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful exploitation can lead to full takeover of the Property Manager application, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation results in complete takeover of Oracle Property Manager, exposing tenant records, lease data, and property financial workflows to unauthorized modification and disclosure.

Affected Products

Oracle E-Business Suite — Oracle Property Manager 12.2.3
Oracle E-Business Suite — Oracle Property Manager versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Property Manager 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60910 published to NVD
2026-07-21 - Last updated in NVD database
Vendor advisory: Oracle Security Alert July 2026

Technical Details for CVE-2026-60910

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Property Manager, an Oracle E-Business Suite module used to manage lease and property lifecycle data. An attacker who already holds high privileges within the application can send crafted HTTP requests to trigger the flaw. The attack requires no user interaction and does not cross a security boundary, meaning exploitation runs within the same scope as the compromised privileged session.

Successful exploitation grants attackers control over Property Manager operations. This exposes lease agreements, tenant identifiers, financial calculations, and integration flows to downstream Oracle Financials modules. The Exploit Prediction Scoring System (EPSS) estimates a probability of 0.367% with a percentile ranking of 29.23 as of 2026-07-23, and no public proof-of-concept has been observed.

Root Cause

Oracle has not published detailed technical root-cause information. Based on the advisory, the weakness stems from insufficient authorization enforcement or unsafe operation handling within an authenticated HTTP interface exposed by the Internal Operations component. The vulnerability permits a privileged user to perform actions beyond their intended operational scope on Property Manager records and configuration.

Attack Vector

Exploitation is network-based over HTTP against the Oracle E-Business Suite web tier. The attacker must authenticate with elevated privileges before delivering the payload. There is no requirement for user interaction, no memory corruption primitive, and no lateral scope change. Given the privileged prerequisite, the most likely abuse path combines credential theft, insider misuse, or chained lower-severity flaws with this vulnerability to escalate impact.

No verified exploit code is available. See the Oracle Security Alert July 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60910

Indicators of Compromise

Unexpected HTTP POST or GET requests to Oracle Property Manager Internal Operations endpoints originating from privileged accounts outside normal working hours.
Modifications to Property Manager configuration tables, lease records, or workflow definitions that lack a corresponding change-management ticket.
Session activity from privileged E-Business Suite accounts using unusual source IP addresses or user-agent strings.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify privileged sessions accessing Property Manager forms and pages.
Correlate application-tier HTTP access logs with database audit trails on PN_* schema tables to detect anomalous write operations.
Alert on repeated administrative actions from a single session that deviate from historical baselines for that user role.

Monitoring Recommendations

Forward Oracle E-Business Suite application, concurrent manager, and database audit logs to a centralized SIEM for correlation with identity telemetry.
Monitor privileged Property Manager role assignments (PROPERTY MANAGER SUPER USER and equivalents) for unauthorized grants.
Track outbound integrations from Property Manager to Oracle General Ledger and Payables for unexpected batch postings.

How to Mitigate CVE-2026-60910

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle E-Business Suite 12.2 to all affected Property Manager instances.
Inventory all 12.2.3 through 12.2.15 deployments and prioritize internet-exposed or partner-connected tiers.
Rotate credentials for high-privileged Property Manager and E-Business Suite administrative accounts.
Review recent Property Manager audit logs for anomalous privileged activity preceding patch deployment.

Patch Information

Oracle addressed CVE-2026-60910 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch numbers, applicability matrices, and post-installation validation steps specific to Oracle E-Business Suite 12.2.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier using firewall rules or reverse-proxy allowlists limited to trusted administrative subnets.
Enforce least-privilege on Property Manager responsibilities and remove standing high-privileged assignments where feasible.
Require multi-factor authentication for all E-Business Suite administrative logins via SSO integration.
Enable Oracle E-Business Suite audit trail on Property Manager tables to preserve evidence pending patch deployment.

bash

# Configuration example: verify EBS patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_PATCH_ID>')
 ORDER BY last_update_date DESC;
EOF