CVE-2026-61020: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61020 Overview

CVE-2026-61020 is a high-severity vulnerability in the Oracle Customers Online product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness to compromise Oracle Customers Online without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Customers Online accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read and modify all data accessible through Oracle Customers Online, including customer records processed by Internal Operations.

Affected Products

Oracle E-Business Suite — Oracle Customers Online 12.2.3
Oracle E-Business Suite — Oracle Customers Online versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Customers Online 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61020 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61020

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Customers Online, a module within Oracle E-Business Suite that manages customer master data and related transactional workflows. An attacker holding any low-privileged application account can send crafted HTTP requests to the affected component. The requests traverse network boundaries and require no additional user interaction to succeed.

Exploitation grants the attacker broad read and write access to data within Oracle Customers Online. This includes the ability to create new records, alter existing customer data, and delete records that support downstream Internal Operations processes. Because Oracle Customers Online integrates with other E-Business Suite modules, tampered records can propagate integrity issues across financial, order management, and CRM workflows.

Oracle's advisory categorizes the issue with high confidentiality and integrity impact but no availability impact, indicating the flaw does not directly disrupt service. The scope remains unchanged, so exploitation stays confined to the vulnerable application context.

Root Cause

Oracle has not published a detailed root cause analysis. The advisory characterizes the issue as an authorization or input handling weakness in HTTP-accessible endpoints of the Internal Operations component, allowing a low-privileged principal to perform operations beyond intended entitlements.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold valid low-privileged credentials for the E-Business Suite environment. Once authenticated, the attacker issues HTTP requests against the vulnerable Oracle Customers Online endpoints exposed by Internal Operations. See the Oracle Security Alert - July 2026 for the definitive component mapping and affected version list.

No verified proof-of-concept exploit code is publicly available. Technical exploitation details are described in prose only, per available advisory data.

Detection Methods for CVE-2026-61020

Indicators of Compromise

Unexpected creation, modification, or deletion of records in Oracle Customers Online tables associated with the Internal Operations component.
HTTP requests to Oracle Customers Online endpoints originating from low-privileged application accounts outside their normal business function.
Session activity from application users showing access patterns inconsistent with their assigned E-Business Suite responsibilities.

Detection Strategies

Enable Oracle E-Business Suite auditing (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for Oracle Customers Online modules and forward events to a centralized log platform.
Correlate application-layer audit trails with web tier access logs to identify HTTP requests that trigger privileged data operations from non-privileged users.
Baseline normal record-change volumes per user and alert on statistical outliers in customer master data mutations.

Monitoring Recommendations

Monitor HTTP 200 responses to OA.jsp and Customers Online servlet endpoints paired with INSERT, UPDATE, or DELETE activity in the underlying database.
Track privilege assignments and responsibility changes for accounts that interact with the Internal Operations component.
Review outbound data flows from the E-Business Suite database to detect bulk extraction of customer records.

How to Mitigate CVE-2026-61020

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15.
Inventory all low-privileged E-Business Suite accounts and revoke access that does not require Oracle Customers Online functionality.
Restrict network reachability of the E-Business Suite web tier to trusted management networks and authenticated VPN paths.

Patch Information

Oracle addressed CVE-2026-61020 in the July 2026 Critical Patch Update. Administrators should follow the remediation guidance in the Oracle Security Alert - July 2026 and apply the corresponding E-Business Suite patch for supported versions 12.2.3 through 12.2.15.

Workarounds

Temporarily disable or restrict responsibilities that grant access to the Oracle Customers Online Internal Operations component until patching is complete.
Place a web application firewall in front of the E-Business Suite web tier and block anomalous requests targeting Customers Online endpoints.
Enforce strict session timeouts and multi-factor authentication for all application users to reduce the window for credential misuse.

bash

# Configuration example: verify installed patch level after applying the July 2026 CPU
adop -status
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('&JULY_2026_CPU_BUG_ID')
 ORDER BY last_update_date DESC;
EOF