CVE-2026-60923: Oracle Capacity Information Disclosure Flaw

CVE-2026-60923 Overview

CVE-2026-60923 is a high-severity vulnerability in the Oracle Capacity product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation results in unauthorized access to critical Oracle Capacity data and produces a scope change, meaning impact extends beyond the vulnerable component to additional products. Oracle addressed this issue in the Oracle Security Alert July 2026.

Critical Impact
A low-privileged network attacker can obtain complete read access to Oracle Capacity data, with impact extending to additional Oracle E-Business Suite products due to scope change.

Affected Products

Oracle E-Business Suite - Oracle Capacity, version 12.2.3
Oracle E-Business Suite - Oracle Capacity, versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Capacity, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60923 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60923

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Capacity, a module of Oracle E-Business Suite used for capacity planning workloads. The issue is exposed over HTTP and is exploitable by an authenticated user holding only low-level privileges. No user interaction is required, and Oracle classifies the flaw as easily exploitable.

The vulnerability affects confidentiality only. Attacks can result in unauthorized disclosure of all data accessible to Oracle Capacity, but integrity and availability remain intact. Oracle indicates a scope change, meaning the affected resource crosses a security boundary and impacts additional Oracle E-Business Suite products beyond Oracle Capacity itself.

The EPSS probability for exploitation stands at 0.371% with a percentile of 29.6 as of 2026-07-23, and no public proof-of-concept or in-the-wild exploitation has been reported at publication time.

Root Cause

Oracle has not released detailed root-cause information for CVE-2026-60923. Based on the vector metrics and the described impact, the flaw permits a low-privileged authenticated user to access data belonging to other users or other Oracle E-Business Suite components through the Internal Operations interface exposed by Oracle Capacity. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Attack Vector

An attacker requires network access to the Oracle E-Business Suite HTTP endpoint and valid low-privilege credentials for the environment. Once authenticated, the attacker issues crafted HTTP requests to the Internal Operations component of Oracle Capacity. Because the vulnerability produces a scope change, the disclosed data may include records outside the Oracle Capacity trust boundary, extending exposure to other Oracle E-Business Suite modules deployed in the same environment.

No public exploitation code is available for CVE-2026-60923. Consult the vendor advisory for reproduction details restricted to licensed customers.

Detection Methods for CVE-2026-60923

Indicators of Compromise

Unusual HTTP request patterns from low-privileged accounts targeting Oracle Capacity Internal Operations URIs.
Anomalous volumes of read operations against Oracle Capacity data tables by accounts that do not normally access these resources.
Authenticated sessions originating from unexpected network segments or geographies accessing Oracle E-Business Suite endpoints.

Detection Strategies

Enable and review Oracle E-Business Suite audit trails for Oracle Capacity and correlate access patterns against baseline user behavior.
Deploy application-layer logging on the HTTP tier to capture URI, parameters, and authenticated user for all requests to Internal Operations endpoints.
Alert on privilege-to-data mismatches where low-privilege accounts read data volumes inconsistent with their role.

Monitoring Recommendations

Forward Oracle E-Business Suite application logs, database audit logs, and web tier access logs to a centralized SIEM for cross-source correlation.
Establish behavioral baselines per role and alert on deviations in access to Oracle Capacity objects.
Monitor Oracle's security alert channel for updated indicators or exploitation reports tied to the July 2026 CPU.

How to Mitigate CVE-2026-60923

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory Oracle E-Business Suite deployments and confirm which instances host the Oracle Capacity module.
Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted user populations pending patch deployment.
Review and tighten low-privilege account provisioning to reduce the attacker pool capable of exploiting this flaw.

Patch Information

Oracle released fixes for CVE-2026-60923 as part of the Oracle Security Alert July 2026. Customers must apply the corresponding Critical Patch Update to Oracle E-Business Suite 12.2.x deployments. Follow Oracle's documented patch application procedures and validate the patched version post-install.

Workarounds

No official vendor workaround has been published; patching is the required remediation path.
Where immediate patching is not feasible, place Oracle E-Business Suite behind a reverse proxy or WAF and restrict access to Internal Operations URIs by network origin and role.
Reduce the number of accounts holding access to Oracle Capacity to limit the pool of potential attackers.
Increase audit logging retention and review frequency for Oracle Capacity access until patching is complete.

bash

# Configuration example: restrict access to Oracle E-Business Suite HTTP tier at the network edge
# Example iptables rule limiting Oracle E-Business Suite HTTP (8000) to a trusted management subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP