CVE-2026-60960: Oracle SDP Privilege Escalation Flaw

CVE-2026-60960 Overview

CVE-2026-60960 is a high-severity vulnerability in the Oracle SDP Number Portability product, a component of Oracle E-Business Suite (EBS). The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with local logon access to the infrastructure where Oracle SDP Number Portability executes can compromise the product. Because the vulnerability has a scope change, successful exploitation may significantly impact additional products beyond Oracle SDP Number Portability itself. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in full takeover of Oracle SDP Number Portability, with high impact to confidentiality, integrity, and availability, and potential lateral impact to adjacent products due to scope change.

Affected Products

Oracle SDP Number Portability version 12.2.3
Oracle SDP Number Portability versions 12.2.4 through 12.2.14
Oracle SDP Number Portability version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60960 published to NVD via the Oracle July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60960

Vulnerability Analysis

CVE-2026-60960 affects the Internal Operations component of Oracle SDP Number Portability, part of Oracle E-Business Suite. Oracle characterizes the flaw as easily exploitable by a low-privileged attacker who already has logon access to the underlying infrastructure. The attack does not require user interaction. Successful exploitation leads to complete takeover of the Oracle SDP Number Portability instance, granting the attacker full read, write, and denial capability over the application. The scope change indicates the vulnerable component can affect resources beyond its own security authority, extending impact to additional Oracle products deployed alongside SDP Number Portability.

Root Cause

Oracle has not published a detailed technical root cause. Based on the advisory, the weakness exists in the Internal Operations component and permits an authenticated local user to escalate privileges and take over the application. Oracle's July 2026 Critical Patch Update is the authoritative source for affected code paths.

Attack Vector

The attack vector is local. The adversary must first authenticate to the host running Oracle SDP Number Portability with any low-privileged account. From that foothold, the attacker interacts with the Internal Operations component to execute actions outside their authorization boundary. The scope change means the compromise can propagate to related Oracle E-Business Suite components sharing the same trust boundary. See the Oracle July 2026 Security Alert for vendor-supplied technical details.

No verified proof-of-concept code is available for CVE-2026-60960.
Refer to the Oracle July 2026 Critical Patch Update advisory
for authoritative technical guidance.

Detection Methods for CVE-2026-60960

Indicators of Compromise

Unexpected process execution or file modifications originating from the Oracle SDP Number Portability application user account on EBS hosts.
New or modified stored procedures, scheduled concurrent programs, or configuration entries within the Internal Operations component.
Local logon events from service or low-privilege accounts followed by privilege changes on Oracle E-Business Suite servers.

Detection Strategies

Correlate local authentication events on EBS hosts with subsequent invocations of SDP Number Portability internal operations to identify anomalous session chains.
Baseline normal administrative activity on EBS application tiers and alert on deviations such as off-hours access or unfamiliar source hosts.
Review Oracle database audit trails for unusual DDL, privilege grants, or DBMS_SCHEDULER jobs invoked by SDP Number Portability accounts.

Monitoring Recommendations

Enable Oracle Unified Auditing and forward audit records to a centralized log platform for retention and correlation.
Monitor operating system logs (/var/log/secure, Windows Security Event Log) for successful local logons to EBS application tier servers.
Track integrity of Oracle E-Business Suite binaries and configuration files with file integrity monitoring.

How to Mitigate CVE-2026-60960

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2026 Critical Patch Update to all Oracle SDP Number Portability deployments running versions 12.2.3 through 12.2.15.
Inventory Oracle E-Business Suite environments and confirm which hosts run the SDP Number Portability module.
Rotate credentials for any low-privilege local accounts on affected hosts that could be leveraged for the initial logon step.

Patch Information

Oracle addresses CVE-2026-60960 in the July 2026 Critical Patch Update. Administrators should download the applicable patch for their Oracle E-Business Suite 12.2.x release from My Oracle Support and follow the documented patch application steps for the SDP Number Portability module. Consult the Oracle July 2026 Security Alert for the complete patch matrix.

Workarounds

Restrict local logon access to Oracle E-Business Suite application tier servers to a minimum set of administrators until patching is complete.
Enforce least privilege on database and OS accounts associated with SDP Number Portability to reduce the pool of accounts capable of initiating exploitation.
Segment EBS hosts on the network so that a compromise cannot easily pivot to adjacent Oracle components affected by the scope change.

bash

# Example: restrict interactive logon on Linux EBS application tier hosts
# Limit SSH access to a defined admin group in /etc/ssh/sshd_config
AllowGroups ebs-admins

# Reload SSH configuration
sudo systemctl reload sshd

# Audit accounts with local logon capability
lastlog | awk '$2 != "**Never" {print}'