CVE-2026-60965: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-60965 Overview

CVE-2026-60965 is a high-severity vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite, affecting the French HR component. Supported versions 12.2.3 through 12.2.15 are impacted. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle HRMS (France). Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle HRMS (France) accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update advisory.

Critical Impact
An authenticated attacker with low privileges can compromise the confidentiality and integrity of all data accessible to Oracle HRMS (France) over the network.

Affected Products

Oracle E-Business Suite - Oracle HRMS (France) versions 12.2.3 through 12.2.15
Component: French HR
Deployments exposing the Oracle E-Business Suite web interface over HTTP

Discovery Timeline

2026-07-21 - CVE CVE-2026-60965 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60965

Vulnerability Analysis

The vulnerability resides in the French HR component of Oracle HRMS (France), part of Oracle E-Business Suite. Oracle's advisory characterizes the issue as easily exploitable over HTTP by an attacker holding valid low-privileged credentials. Successful attacks compromise confidentiality and integrity but do not affect availability. The scope remains unchanged, meaning the impact is limited to the vulnerable component and the data it manages.

Because Oracle HRMS stores workforce data such as employee records, payroll inputs, and personal identifiers subject to French and EU data protection regulations, exploitation carries direct data protection and regulatory consequences. The attack surface is the standard HTTP/HTTPS interface exposed by Oracle E-Business Suite deployments.

Root Cause

Oracle has not published a detailed root-cause analysis in its public advisory. The advisory indicates the flaw permits both read and write access to data managed by the French HR module, consistent with a broken access control or improper authorization defect in a module endpoint. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack vector is network-based over HTTP. The attacker must possess valid low-privileged credentials to the Oracle E-Business Suite environment. No user interaction is required, and the attack complexity is low. Attackers typically leverage such flaws to read HR records, alter employee or payroll data, or stage further lateral movement within the E-Business Suite tenant.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.365%.

Detection Methods for CVE-2026-60965

Indicators of Compromise

Unexpected HTTP requests from low-privileged EBS user sessions targeting French HR (per_*, pay_*, or French HR-specific) URLs and servlets
Unusual read or write operations against Oracle HRMS (France) tables outside normal HR business hours
Audit log entries showing data modifications by user accounts that do not have a business function tied to French HR administration

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify anomalous access to French HR pages
Correlate application-tier HTTP access logs with database audit trails on HR schemas to identify low-privileged accounts performing sensitive operations
Alert on privilege-to-action mismatches, such as accounts without HRMS responsibilities invoking French HR functions

Monitoring Recommendations

Forward Oracle EBS application, middle-tier, and database audit logs to a centralized SIEM for continuous analysis
Baseline typical French HR usage patterns and generate alerts on volumetric or off-hours deviations
Monitor for post-exploitation behavior such as bulk exports of employee records or unexpected changes to payroll parameters

How to Mitigate CVE-2026-60965

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite on all instances running versions 12.2.3 through 12.2.15
Inventory all Oracle EBS environments and confirm whether the HRMS (France) module is licensed and deployed
Review recent access to French HR functions by low-privileged accounts and investigate any anomalies
Rotate credentials for any accounts suspected of misuse

Patch Information

Oracle addressed CVE-2026-60965 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and application instructions specific to Oracle E-Business Suite 12.2.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier using a reverse proxy or WAF that limits which authenticated users can reach French HR endpoints
Remove or scope down responsibilities and menus that expose the French HR module to users who do not require it
Enforce strong authentication and session controls on all EBS user accounts to reduce the risk of credential abuse

bash

# Configuration example: apply the July 2026 CPU patch on an Oracle EBS 12.2 environment
# Refer to the Oracle CPU advisory and README for exact patch numbers.

# 1. Source the environment
. $EBS_HOME/EBSapps.env run

# 2. Prepare online patching cycle
adop phase=prepare

# 3. Apply the July 2026 CPU patch (replace <patch_id> with the value from Oracle's advisory)
adop phase=apply patches=<patch_id> workers=8

# 4. Finalize, cutover, and cleanup
adop phase=finalize
adop phase=cutover
adop phase=cleanup