CVE-2026-60939: Oracle Project Contracts Disclosure Flaw

CVE-2026-60939 Overview

CVE-2026-60939 affects the Oracle Project Contracts product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful exploitation results in unauthorized read access to a subset of Oracle Project Contracts data. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
An authenticated remote attacker can obtain unauthorized read access to a subset of Oracle Project Contracts data, resulting in limited confidentiality impact without affecting integrity or availability.

Affected Products

Oracle E-Business Suite Oracle Project Contracts 12.2.3 through 12.2.15
Internal Operations component
Deployments exposing HTTP endpoints to network-reachable users

Discovery Timeline

2026-07-21 - CVE-2026-60939 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60939

Vulnerability Analysis

CVE-2026-60939 is an information disclosure vulnerability in the Internal Operations component of Oracle Project Contracts. An authenticated user with low privileges can send crafted HTTP requests to the affected component and retrieve data that should be restricted. Oracle classifies this as difficult to exploit, indicating that specific conditions beyond the attacker's control must be present. The disclosed data is limited to a subset of Oracle Project Contracts accessible information. Integrity and availability of the application are not affected.

Root Cause

The root cause resides in insufficient authorization enforcement on data returned by the Internal Operations component. When a low-privileged authenticated session interacts with the affected functionality over HTTP, the application returns a subset of records without applying the expected access control checks. This aligns with the Broken Access Control category. Oracle has not published detailed root cause information beyond the advisory.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. No user interaction is required. The attacker interacts with the Internal Operations component of Oracle Project Contracts by issuing HTTP requests that return data the account is not authorized to view. The high attack complexity indicates non-trivial preconditions, such as timing, configuration state, or specific request sequencing.

No verified proof-of-concept code is publicly available. Technical details are limited to the Oracle Security Alert July 2026.

Detection Methods for CVE-2026-60939

Indicators of Compromise

Anomalous HTTP requests from low-privileged Oracle E-Business Suite accounts targeting Project Contracts Internal Operations URLs
Access patterns where a single authenticated user enumerates Project Contracts records outside their assigned scope
Unexpected 200 OK responses on Project Contracts endpoints for accounts without Project Contracts responsibilities

Detection Strategies

Enable Oracle E-Business Suite auditing and sign-on audit at the FORM level to capture user access to Project Contracts responsibilities
Baseline normal Project Contracts request volume per user role and alert on statistical outliers
Correlate web tier access logs with Oracle FND user sessions to identify low-privileged accounts reaching Internal Operations endpoints

Monitoring Recommendations

Forward Oracle EBS application logs, Apache/OHS access logs, and database audit logs to a centralized SIEM for correlation
Monitor for repeated queries against PA_% and Project Contracts tables originating from application accounts with minimal privileges
Track outbound data volumes from EBS middle-tier servers to detect bulk enumeration of Project Contracts data

How to Mitigate CVE-2026-60939

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments
Inventory user accounts assigned Project Contracts responsibilities and remove unnecessary access
Restrict network access to the Oracle E-Business Suite HTTP endpoints to trusted segments and VPN users

Patch Information

Oracle addressed CVE-2026-60939 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the corresponding patch for their Oracle E-Business Suite 12.2 release level. Test the patch in a non-production environment before promoting to production.

Workarounds

Remove Project Contracts responsibilities from users who do not require them until the patch is applied
Place the Oracle E-Business Suite external tier behind a web application firewall with rules restricting access to Internal Operations paths
Enforce strong password policies and multi-factor authentication for all EBS accounts to raise the bar for the required low-privilege access

bash

# Verify installed EBS patch level and Project Contracts module version
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('&JULY_2026_CPU_BUG');
SELECT application_short_name, product_version
  FROM fnd_product_installations fpi
  JOIN fnd_application fa ON fpi.application_id = fa.application_id
 WHERE fa.application_short_name = 'PA';
EOF