CVE-2026-60978: Oracle Scripting Privilege Escalation

CVE-2026-60978 Overview

CVE-2026-60978 is a vulnerability in the Oracle Scripting product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An attacker with high privileges and network access via HTTP can compromise Oracle Scripting to gain unauthorized read, create, delete, or modify access to all Oracle Scripting accessible data.

Oracle disclosed the issue in the Oracle Security Alert July 2026. The vulnerability does not impact availability but affects both confidentiality and integrity at scale within the affected component.

Critical Impact
Authenticated attackers with high privileges can read, create, modify, or delete all data accessible to Oracle Scripting over HTTP.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Scripting product (Internal Operations component)
Deployments exposing Oracle E-Business Suite over HTTP

Discovery Timeline

2026-07-21 - CVE CVE-2026-60978 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Included in Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60978

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Scripting, part of the Oracle E-Business Suite (EBS) application platform. Oracle Scripting supports customer interaction scripting for call center and self-service flows and interoperates with several EBS modules.

An attacker with an authenticated, high-privileged session can send crafted HTTP requests to Scripting endpoints. Successful exploitation results in unauthorized access to critical data and unauthorized modification, creation, or deletion of records handled by Oracle Scripting. Oracle rates the flaw as easily exploitable when the privilege prerequisite is met.

The scope is unchanged, meaning impact is confined to the vulnerable component's security authority. Availability is not affected, so this is not a denial-of-service condition. The confidentiality and integrity impacts are both rated high, reflecting complete access to Scripting-accessible data.

The EPSS score is 0.381% with a percentile of 30.6, indicating a low modeled probability of exploitation activity in the near term. No public proof-of-concept exploit or entry in the CISA Known Exploited Vulnerabilities catalog is available at time of writing.

Root Cause

Oracle has not published root-cause details for CVE-2026-60978. Based on the advisory metadata, the defect appears to be an access control or input validation weakness in a Scripting Internal Operations HTTP handler that permits a privileged user to reach or modify data outside the boundary the application intends to enforce.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP tier and an authenticated session with high privileges. No user interaction is needed. The attacker issues HTTP requests to the affected Oracle Scripting endpoints to trigger the unauthorized data operations.

Refer to the Oracle Security Alert July 2026 for the vendor-supplied technical description and patch mapping. No verified public exploit code is available.

Detection Methods for CVE-2026-60978

Indicators of Compromise

Unexpected HTTP requests from authenticated Oracle EBS sessions to Oracle Scripting Internal Operations URLs
Unusual create, update, or delete operations on Oracle Scripting tables outside normal business hours
Privileged EBS accounts issuing large volumes of Scripting API calls in short intervals

Detection Strategies

Enable and centrally collect Oracle E-Business Suite application and mid-tier HTTP access logs, focusing on Scripting module URIs.
Baseline normal Scripting activity per privileged user and alert on deviation in request rate, verbs, or accessed record sets.
Correlate Oracle database audit records for Scripting-owned schemas against application session identifiers to identify out-of-band data changes.

Monitoring Recommendations

Ingest EBS access, concurrent manager, and database audit logs into your SIEM with OCSF normalization for correlation.
Alert on privileged EBS role assignments and any use of Scripting Internal Operations endpoints by accounts that do not normally invoke them.
Track integrity-sensitive Scripting tables with database-level change auditing and file integrity monitoring on EBS mid-tier binaries.

How to Mitigate CVE-2026-60978

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite 12.2.3–12.2.15 environments.
Inventory privileged accounts with access to Oracle Scripting and revoke unnecessary high-privilege role grants.
Restrict network access to the EBS HTTP tier so it is reachable only from trusted management networks or via authenticated reverse proxy.

Patch Information

Oracle published fixes for CVE-2026-60978 as part of the Oracle Security Alert July 2026. Administrators should identify the correct patch bundle for their EBS release level and apply it following Oracle's documented pre- and post-patch steps for the E-Business Suite mid-tier and database.

Workarounds

Enforce least privilege on Oracle EBS responsibilities and menus so that only required users have Scripting administration access.
Terminate stale privileged sessions and rotate credentials for accounts capable of reaching Oracle Scripting Internal Operations.
Place a web application firewall or reverse proxy in front of the EBS HTTP tier and restrict access to Scripting URIs to authorized source addresses.

bash

# Example: restrict Oracle Scripting Internal Operations paths at a reverse proxy
# nginx location block limiting access to trusted admin CIDR ranges
location ~* /OA_HTML/.*(Scripting|jtfIhScripting).* {
    allow 10.20.30.0/24;
    deny all;
    proxy_pass http://ebs-midtier-upstream;
}