CVE-2026-60985: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-60985 Overview

CVE-2026-60985 is a high-severity vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data across all Oracle Project Portfolio Analysis accessible data, and can cause a partial denial of service. Oracle disclosed the issue in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
Authenticated attackers can tamper with or destroy Oracle Project Portfolio Analysis data across the application and degrade its availability over the network.

Affected Products

Oracle E-Business Suite — Oracle Project Portfolio Analysis, version 12.2.3
Oracle E-Business Suite — Oracle Project Portfolio Analysis, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Portfolio Analysis, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60985 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60985

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Project Portfolio Analysis, part of the Oracle E-Business Suite. An attacker who already holds a low-privileged application account can send crafted HTTP requests to the affected endpoints. The attack complexity is low, and no user interaction is required to trigger the flaw.

Exploitation grants attackers unauthorized write access to critical business data managed by Oracle Project Portfolio Analysis. Attackers can create, modify, or delete records in the application. Exploitation can also disrupt normal operation of the service, producing a partial denial of service. Confidentiality is not directly affected, but integrity impact is high and availability impact is low.

Root Cause

Oracle has not publicly disclosed the underlying defect class. Based on the exposure profile — network-reachable HTTP interface, low privileges required, and integrity-dominant impact — the flaw is consistent with insufficient authorization enforcement or improper input validation within an Internal Operations request handler. See the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is Network over HTTP. An attacker requires an authenticated session with low privileges on the Oracle E-Business Suite instance. Once authenticated, the attacker submits crafted requests to the Oracle Project Portfolio Analysis Internal Operations endpoints. No victim interaction, elevated privileges, or local access is required. As of publication, no public proof-of-concept exploit is available, and the vulnerability is not listed in CISA KEV. EPSS is 0.269% at the 18.8th percentile.

No verified exploit code is publicly available. Refer to the vendor advisory for authoritative technical detail.

Detection Methods for CVE-2026-60985

Indicators of Compromise

Unexpected create, update, or delete operations in Oracle Project Portfolio Analysis tables authored by low-privileged application accounts.
HTTP requests targeting Internal Operations endpoints from user sessions that historically do not access those functions.
Anomalous bursts of write activity from a single Oracle E-Business Suite session, followed by transient service errors indicative of a partial denial of service.

Detection Strategies

Enable and review Oracle E-Business Suite audit trail (FND_AUDIT) on Project Portfolio Analysis tables to identify unauthorized data modifications.
Correlate application server access logs against user role assignments to detect access to Internal Operations URLs by users lacking business need.
Alert on integrity-changing HTTP verbs (POST, PUT, DELETE) issued to Project Portfolio Analysis endpoints outside normal business processes.

Monitoring Recommendations

Forward Oracle HTTP Server and WebLogic access logs to a centralized SIEM and baseline per-user request patterns for Project Portfolio Analysis modules.
Monitor database change volumes for PA_* schema objects and alert on statistical deviations from historical baselines.
Track authentication events for low-privilege service and functional accounts, prioritizing sessions that pivot toward administrative or Internal Operations pages.

How to Mitigate CVE-2026-60985

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite 12.2.3 through 12.2.15 in accordance with the Oracle Security Alert July 2026.
Review and reduce low-privileged account access to Oracle Project Portfolio Analysis, especially accounts that can reach Internal Operations pages.
Enable full audit logging on Project Portfolio Analysis tables and retain logs for forensic review.

Patch Information

Oracle addressed CVE-2026-60985 in the July 2026 Critical Patch Update. Administrators should identify the corresponding patch for their exact Oracle E-Business Suite release (12.2.3 through 12.2.15) from the Oracle advisory and apply it during the next available maintenance window. Oracle recommends applying Critical Patch Updates without delay.

Workarounds

Restrict network reachability to Oracle E-Business Suite HTTP endpoints from untrusted networks using a reverse proxy or Web Application Firewall until patches are applied.
Temporarily remove Project Portfolio Analysis responsibility assignments from non-essential users to reduce the pool of accounts capable of exploiting the flaw.
Increase audit sampling and manual review cadence for Project Portfolio Analysis data changes until patching is verified in all environments.

bash

# Example: verify installed Oracle E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('&july2026_cpu_bug_id')
 ORDER BY last_update_date DESC;
EXIT;
EOF