CVE-2026-60917: Oracle Inventory Management Auth Bypass

CVE-2026-60917 Overview

CVE-2026-60917 is a high-severity vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite, specifically within the Core Receiving component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle Inventory Management. Successful exploitation grants unauthorized creation, deletion, or modification access to critical data, as well as unauthorized read access to all Oracle Inventory Management accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read and modify all data accessible to Oracle Inventory Management, impacting both confidentiality and integrity of ERP receiving operations.

Affected Products

Oracle E-Business Suite — Oracle Inventory Management 12.2.3
Oracle E-Business Suite — Oracle Inventory Management 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Inventory Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60917 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Fix included in Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60917

Vulnerability Analysis

The vulnerability resides in the Core Receiving component of Oracle Inventory Management, part of the broader Oracle E-Business Suite (EBS) platform. According to Oracle, the issue is easily exploitable over HTTP by an attacker holding a low-privileged authenticated session. The scope remains unchanged, meaning exploitation impacts resources managed by the same security authority as the vulnerable component. Confidentiality and integrity impacts are rated high, while availability is not affected. This profile is consistent with a data-layer flaw that lets an authenticated user bypass intended access controls on receiving records and related inventory data.

Root Cause

Oracle has not published a detailed root-cause analysis in the public advisory. The combination of low required privileges, network attack vector, and high confidentiality and integrity impact points to a missing or broken authorization check on server-side operations exposed by the Core Receiving module. See the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP endpoints and valid low-privileged credentials. An attacker with a standard EBS user account can craft HTTP requests to Core Receiving functionality that were expected to be constrained to higher-privileged roles. Successful requests yield unauthorized read, create, modify, or delete operations against Inventory Management data. No user interaction is required, and attack complexity is low, which increases the practical exploitability inside enterprise environments where EBS is exposed to broad user populations.

No verified public proof-of-concept code is available at this time. Refer to Oracle's advisory for authoritative technical details.

Detection Methods for CVE-2026-60917

Indicators of Compromise

Unexpected create, update, or delete operations on Inventory Management receiving records performed by low-privileged EBS accounts.
Anomalous HTTP requests to Core Receiving servlets and JSP endpoints originating from user sessions that historically only performed read operations.
EBS audit trail entries showing access to inventory records outside a user's assigned organization or responsibility.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for Inventory Management responsibilities.
Correlate Oracle HTTP Server (OHS) access logs with EBS application audit logs to identify HTTP requests that map to sensitive Core Receiving actions by non-privileged users.
Baseline normal request patterns per responsibility and alert on deviations, particularly bulk read or write operations against MTL_* and RCV_* tables.

Monitoring Recommendations

Forward OHS, WebLogic, and EBS FND audit logs to a centralized SIEM for correlation and long-term retention.
Monitor privileged database activity on receiving and inventory tables using Oracle Database Vault or native auditing.
Alert on failed authorization events and repeated 200-status responses to Core Receiving endpoints from a single low-privileged session.

How to Mitigate CVE-2026-60917

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all affected 12.2.x environments.
Inventory all EBS instances, including non-production, and confirm the Inventory Management patch level after deployment.
Restrict network exposure of EBS HTTP endpoints to trusted networks and VPN users until patching completes.
Review recent Core Receiving activity for signs of unauthorized data modification prior to patch application.

Patch Information

Oracle released fixes for CVE-2026-60917 as part of the Oracle Critical Patch Update Advisory - July 2026. Administrators should follow the patch application instructions specific to Oracle E-Business Suite 12.2 and apply the associated Inventory Management and technology stack updates.

Workarounds

No vendor-supplied workaround replaces patching. Reduce risk by tightening EBS responsibility assignments and removing unnecessary Inventory Management access for general user accounts.
Place a web application firewall or reverse proxy in front of EBS to rate-limit and inspect requests to Core Receiving endpoints.
Enforce multi-factor authentication on all EBS user accounts to raise the cost of credential-based access required for exploitation.

bash

# Verify applied Oracle E-Business Suite patches (example)
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<july_2026_cpu_bug_id>')
 ORDER BY last_update_date DESC;
EOF