CVE-2026-60963: Oracle Treasury Auth Bypass Vulnerability

CVE-2026-60963 Overview

CVE-2026-60963 is a high-severity vulnerability in the Internal Operations component of Oracle Treasury, part of Oracle E-Business Suite. Affected versions span 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation grants unauthorized read, create, modify, and delete access to all Oracle Treasury data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can read and tamper with all Oracle Treasury data, compromising financial records, treasury transactions, and internal operations records.

Affected Products

Oracle E-Business Suite — Oracle Treasury version 12.2.3
Oracle E-Business Suite — Oracle Treasury versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Treasury version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60963 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Fix released in the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-60963

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Treasury within Oracle E-Business Suite. An attacker holding any low-privileged Oracle E-Business Suite account can reach the vulnerable HTTP endpoints across the network. The exploitation path does not require user interaction, and the attack complexity is low. Successful exploitation impacts confidentiality and integrity, enabling read access to all Oracle Treasury data and unauthorized creation, deletion, or modification of that data. Availability is not affected. Because Oracle Treasury handles cash management, deals, settlements, and bank account information, unauthorized modification can result in financial fraud and misstated accounting records. Refer to the Oracle Security Alert - July 2026 for Oracle's advisory details.

Root Cause

Oracle has not published root-cause specifics for CVE-2026-60963. The advisory attributes the weakness to the Internal Operations component of Oracle Treasury and characterizes it as easily exploitable by an authenticated low-privileged actor over HTTP. No CWE identifier has been assigned in the NVD record.

Attack Vector

The attack vector is network-based over HTTP or HTTPS against the Oracle E-Business Suite application tier. The attacker must first authenticate with low privileges, then issue crafted requests to the Oracle Treasury Internal Operations endpoints. EPSS currently rates exploitation probability at 0.365% (percentile 29.03) as of 2026-07-23. No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert - July 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60963

Indicators of Compromise

Unexpected HTTP requests from authenticated low-privileged users to Oracle Treasury Internal Operations URLs on the Oracle E-Business Suite application tier.
Unexplained creation, modification, or deletion of Treasury records such as deals, settlements, or bank account data outside normal business workflows.
Anomalous database INSERT, UPDATE, or DELETE activity against Oracle Treasury tables initiated by application accounts with no functional need for those operations.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to correlate low-privileged sessions with access to Treasury Internal Operations pages.
Enable Oracle Database Fine-Grained Auditing on Treasury schema tables (XTR_*) to flag write operations from unexpected responsibilities.
Deploy web application firewall or reverse proxy inspection to log all requests hitting Oracle Treasury endpoints, then baseline expected caller identities.

Monitoring Recommendations

Forward Oracle E-Business Suite application logs, Apache/OHS access logs, and database audit logs to a central SIEM for correlation.
Alert on privilege-to-URL mismatches where accounts without Treasury responsibilities access Treasury Internal Operations pages.
Track patch inventory for Oracle E-Business Suite 12.2.3 through 12.2.15 deployments and confirm the July 2026 Critical Patch Update is applied.

How to Mitigate CVE-2026-60963

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.x environments running Oracle Treasury.
Inventory all user accounts with access to Oracle E-Business Suite and revoke unnecessary low-privilege access to reduce the exploitable population.
Restrict network exposure of the Oracle E-Business Suite application tier so it is not reachable from untrusted networks or the public internet.
Rotate credentials and review audit logs for any authenticated access to Treasury Internal Operations pages prior to patching.

Patch Information

Oracle addressed CVE-2026-60963 in the Oracle Critical Patch Update - July 2026. Customers running Oracle E-Business Suite 12.2.3 through 12.2.15 must apply the corresponding Oracle Treasury patch identified in that advisory. Oracle recommends applying Critical Patch Update fixes without delay because active exploitation attempts against unpatched systems are common.

Workarounds

No official workaround has been published by Oracle; applying the July 2026 Critical Patch Update is the required remediation.
As a compensating control, place Oracle E-Business Suite behind a reverse proxy or WAF that restricts access to Oracle Treasury URLs to authorized user populations.
Tighten Oracle E-Business Suite responsibility assignments so only treasury and finance staff hold responsibilities that grant access to Treasury functions.