CVE-2026-60913: Oracle Property Manager Info Disclosure

CVE-2026-60913 Overview

CVE-2026-60913 is an information disclosure vulnerability in the Oracle Property Manager product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. Successful exploitation requires a high-privileged attacker with logon access to the infrastructure where Oracle Property Manager executes. The attack complexity is high, and exploitation results in unauthorized read access to a subset of Oracle Property Manager data. No integrity or availability impact exists. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
A local, high-privileged attacker can obtain unauthorized read access to a subset of Oracle Property Manager data, exposing confidential business records.

Affected Products

Oracle E-Business Suite — Oracle Property Manager 12.2.3
Oracle E-Business Suite — Oracle Property Manager versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Property Manager 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60913 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60913

Vulnerability Analysis

CVE-2026-60913 is an information disclosure issue in Oracle Property Manager, a real estate management module within Oracle E-Business Suite. The vulnerability sits in the Internal Operations component, which handles administrative and background processing tasks. An authenticated attacker with high privileges on the host running Oracle Property Manager can access data that should remain restricted. Because the scope is unchanged and only confidentiality is affected, the impact is confined to a subset of records accessible through the vulnerable component. The EPSS score is 0.121%, indicating a low likelihood of near-term exploitation activity. No public proof-of-concept, exploit code, or evidence of in-the-wild abuse has been reported.

Root Cause

Oracle has not published detailed technical root cause information. Based on the CVSS profile, the flaw allows a privileged local user to read data through the Internal Operations component that should be protected by access control boundaries. Refer to the Oracle Security Advisory July 2026 for vendor-provided context.

Attack Vector

Exploitation requires local access to the infrastructure where Oracle Property Manager runs. The attacker must already hold high privileges on that infrastructure and must overcome conditions that make exploitation difficult. No user interaction is required. Once these prerequisites are met, the attacker can read a subset of confidential Property Manager data without altering records or disrupting service.

No verified public exploit code is available for CVE-2026-60913. See the Oracle Security Advisory July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60913

Indicators of Compromise

Unexpected read operations against Oracle Property Manager tables originating from Internal Operations processes or accounts.
Anomalous access patterns from privileged operating system or database accounts on the Property Manager application tier.
Presence of unpatched Oracle E-Business Suite Property Manager versions 12.2.3 through 12.2.15 prior to the July 2026 CPU.

Detection Strategies

Enable Oracle E-Business Suite audit logging on the Property Manager schema and monitor for queries executed outside normal business processes.
Correlate operating system logon events on the Property Manager application server with subsequent database read activity.
Alert on privileged account use during off-hours or from unexpected sessions on the E-Business Suite application tier.

Monitoring Recommendations

Forward Oracle E-Business Suite application, concurrent manager, and database audit logs to a centralized SIEM for retention and correlation.
Baseline typical Internal Operations activity and alert on deviations in query volume or scope.
Track patch level of all E-Business Suite environments and flag hosts still running vulnerable Property Manager releases.

How to Mitigate CVE-2026-60913

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite environments running Property Manager versions 12.2.3 through 12.2.15.
Inventory hosts running Oracle Property Manager and confirm patch status against the vendor advisory.
Restrict interactive and administrative logon on Property Manager application servers to a minimal set of vetted accounts.

Patch Information

Oracle released fixes for CVE-2026-60913 as part of the July 2026 Critical Patch Update. Administrators should download and apply the relevant patches for Oracle E-Business Suite 12.2 as described in the Oracle Security Advisory July 2026. Validate patch application in a non-production environment before rolling out to production Property Manager instances.

Workarounds

Enforce least privilege on the Property Manager application tier and remove unnecessary high-privileged local accounts.
Require multi-factor authentication and jump-host access for administrators who log on to the E-Business Suite infrastructure.
Segment the Property Manager application and database servers from general corporate networks to limit local access opportunities.

bash

# Example: verify installed Oracle E-Business Suite patch level
sqlplus -s apps/<password> <<EOF
SET PAGESIZE 0 FEEDBACK OFF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_PATCH_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF