CVE-2026-60911: Oracle Property Manager Auth Bypass Flaw

CVE-2026-60911 Overview

CVE-2026-60911 is a vulnerability in the Oracle Property Manager product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability, though successful attacks require user interaction from a person other than the attacker. While the vulnerability resides in Oracle Property Manager, exploitation can produce a scope change that impacts additional products. Successful exploitation grants unauthorized update, insert, or delete access to some Property Manager data and unauthorized read access to a subset of Property Manager data.

Critical Impact
Authenticated attackers can leverage user interaction to modify and read Oracle Property Manager data, with a scope change enabling impact on adjacent Oracle E-Business Suite components.

Affected Products

Oracle E-Business Suite — Oracle Property Manager version 12.2.3
Oracle E-Business Suite — Oracle Property Manager versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Property Manager version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60911 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60911

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Property Manager, part of Oracle E-Business Suite. An authenticated attacker with low privileges can send crafted HTTP requests that trigger the flaw. Exploitation requires interaction from a separate user, which aligns the issue with client-driven attack patterns such as cross-site request forgery or malicious link delivery to a privileged operator.

The advisory notes a scope change, meaning the impact of exploitation extends beyond the vulnerable Property Manager module to additional Oracle E-Business Suite products. Attackers gain the ability to insert, update, or delete a subset of Property Manager data and to read a subset of Property Manager data. Availability is not affected.

The EPSS probability score is 0.213% with a percentile of 11.66, indicating a low near-term likelihood of observed exploitation. No public proof-of-concept is currently referenced in the enriched data.

Root Cause

Oracle has not published low-level technical details for this issue. The advisory attributes the weakness to logic within the Internal Operations component of Oracle Property Manager. The combination of required user interaction and a scope change is consistent with insufficient validation of cross-origin requests or improper trust boundaries between the module and other E-Business Suite components. Refer to the Oracle Security Alert - July 2026 for authoritative remediation guidance.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker must already hold a low-privileged account on the target Oracle E-Business Suite deployment. The attacker then coerces another user, typically a more privileged operator, into interacting with attacker-controlled content. This interaction triggers the vulnerable code path in Property Manager and produces the scope change that affects adjacent products.

Detection Methods for CVE-2026-60911

Indicators of Compromise

Unexpected insert, update, or delete operations against Oracle Property Manager tables performed by low-privileged accounts.
HTTP requests to Oracle Property Manager Internal Operations endpoints originating from external Referer headers or unusual client sessions.
Access log entries where a Property Manager action is followed by activity in unrelated Oracle E-Business Suite modules within the same session.

Detection Strategies

Baseline normal Property Manager transaction volumes per user role and alert on anomalous write activity from accounts without a business need.
Correlate Oracle E-Business Suite audit logs with web server access logs to identify HTTP requests that trigger cross-module changes.
Monitor for session activity that spans Property Manager and other E-Business Suite components in patterns inconsistent with prior user behavior.

Monitoring Recommendations

Enable Oracle E-Business Suite auditing on Property Manager tables and Internal Operations endpoints, and forward the logs to a centralized analytics platform.
Ingest Oracle E-Business Suite and reverse proxy logs into Singularity Data Lake to run OCSF-normalized queries across authentication, HTTP, and database events.
Track privileged user sessions that receive external links or attachments immediately before performing Property Manager operations.

How to Mitigate CVE-2026-60911

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running Property Manager versions 12.2.3 through 12.2.15.
Inventory all Property Manager accounts and remove or restrict low-privileged accounts that do not require Internal Operations access.
Review recent Property Manager audit logs for unauthorized inserts, updates, or deletes that predate patch installation.

Patch Information

Oracle addressed CVE-2026-60911 in the Oracle Critical Patch Update Advisory - July 2026. Administrators must apply the corresponding E-Business Suite patch bundle to any deployment running Oracle Property Manager 12.2.3 through 12.2.15. Verify the patch through Oracle My Oracle Support before staging to production.

Workarounds

Restrict HTTP access to Oracle E-Business Suite interfaces using network segmentation and allowlists until patches are deployed.
Enforce strict SameSite cookie policies and anti-CSRF controls at the reverse proxy layer to reduce the impact of user-interaction attack chains.
Educate Property Manager users on the risk of interacting with unsolicited links while authenticated to Oracle E-Business Suite.

bash

# Example: restrict Oracle E-Business Suite HTTP access at the reverse proxy
# (adapt to your environment before deployment)
location /OA_HTML/ {
    allow 10.0.0.0/8;      # trusted internal range
    deny  all;
    proxy_set_header Referer $http_referer;
    add_header Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Strict";
    proxy_pass http://ebs-backend;
}