CVE-2026-60997: Oracle Universal Work Queue Auth Bypass

CVE-2026-60997 Overview

CVE-2026-60997 is a high-severity vulnerability in the Oracle Universal Work Queue component of Oracle E-Business Suite. The flaw affects the Non-Media Integration subcomponent in supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this issue to compromise Oracle Universal Work Queue. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with full read access to Oracle Universal Work Queue accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read and modify all data accessible to Oracle Universal Work Queue, impacting both confidentiality and integrity of E-Business Suite operations.

Affected Products

Oracle E-Business Suite - Universal Work Queue 12.2.3
Oracle E-Business Suite - Universal Work Queue 12.2.4 through 12.2.14
Oracle E-Business Suite - Universal Work Queue 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60997 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60997

Vulnerability Analysis

The vulnerability resides in the Non-Media Integration component of Oracle Universal Work Queue, a task-routing module within Oracle E-Business Suite. The flaw is exploitable over HTTP by an attacker holding only low-level application privileges. No user interaction is required, and exploitation does not depend on complex preconditions.

Successful attacks compromise both confidentiality and integrity. An attacker can read every record accessible to Universal Work Queue and create, alter, or delete critical business data. Availability of the service is not directly impacted according to Oracle's assessment.

Oracle rates the issue as easily exploitable, meaning routine authenticated access to the Oracle E-Business Suite web tier is sufficient to reach the vulnerable interface. The EPSS score is 0.365% with a percentile of 29.03 as of 2026-07-23.

Root Cause

Oracle has not published the underlying weakness class or code-level defect. No CWE identifier is assigned in the NVD entry. Based on the impact profile — network-reachable HTTP surface, low-privilege authenticated attacker, and full read/write access to Universal Work Queue data — the defect is consistent with a broken access control or improper authorization condition in the Non-Media Integration interface.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite application tier. The attacker must hold a valid low-privilege account on the target instance. Once authenticated, the attacker sends crafted requests to the Universal Work Queue Non-Media Integration endpoint. No verified proof-of-concept exploit code is publicly available. Refer to the Oracle Security Alert July 2026 for the vendor's technical description.

Detection Methods for CVE-2026-60997

Indicators of Compromise

Unexpected HTTP POST or GET requests to Universal Work Queue endpoints under /OA_HTML/ from low-privileged application user sessions.
Anomalous read, insert, update, or delete operations against Universal Work Queue tables (IEU_* schema) by non-administrative accounts.
Session activity from accounts accessing Universal Work Queue functions outside their assigned responsibilities.

Detection Strategies

Enable Oracle E-Business Suite audit policies on IEU_* tables and the FND user session log to capture data-modification events.
Correlate application-tier web server logs with database audit records to identify sequences where a low-privileged session performs privileged data changes.
Baseline typical Universal Work Queue request patterns per user role and alert on deviations in volume or endpoint scope.

Monitoring Recommendations

Forward Oracle HTTP Server and database audit logs to a central SIEM for retention and correlation.
Monitor for privilege escalation patterns where a standard user account issues administrative Universal Work Queue calls.
Alert on off-hours activity against Oracle E-Business Suite web tier endpoints associated with ieu servlets.

How to Mitigate CVE-2026-60997

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fix for Oracle E-Business Suite Universal Work Queue.
Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and prioritize internet-exposed environments.
Review and reduce the population of accounts with access to Universal Work Queue responsibilities.
Rotate credentials for any accounts suspected of compromise following log review.

Patch Information

Oracle addressed CVE-2026-60997 in the July 2026 Critical Patch Update. Administrators must download and apply the patch referenced in the Oracle Security Alert July 2026. Oracle notes that CPU patches are cumulative and should be installed following the vendor's documented pre-installation and validation steps for E-Business Suite 12.2.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier so that only trusted internal networks or VPN clients can reach Universal Work Queue endpoints.
Remove Universal Work Queue responsibilities from user accounts that do not require the module until patching completes.
Enforce web application firewall rules that limit request rates and block anomalous parameter values on ieu servlet paths.

bash

# Example: restrict access to Universal Work Queue endpoints at the reverse proxy
# Apache HTTP Server configuration fronting Oracle E-Business Suite
<Location /OA_HTML/ieu>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>