CVE-2026-61075: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61075 Overview

CVE-2026-61075 affects the Oracle Self-Service Human Resources product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in unauthorized update, insert, or delete access to a subset of application data, as well as unauthorized read access to a subset of data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated remote attackers can modify and read a subset of Oracle Self-Service Human Resources data over HTTP with low complexity and no user interaction.

Affected Products

Oracle E-Business Suite — Oracle Self-Service Human Resources 12.2.3 through 12.2.15
Component: Internal Operations
Deployments exposing Oracle E-Business Suite HTTP endpoints to networked users

Discovery Timeline

2026-07-21 - CVE-2026-61075 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61075

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Self-Service Human Resources, a module of Oracle E-Business Suite. An attacker with a valid low-privileged application account can send crafted HTTP requests to reach functionality that performs read and write operations on application data. The attack does not require user interaction and executes over the network.

The impact is scoped to a subset of Oracle Self-Service Human Resources accessible data. Confidentiality and integrity are affected at a low level, while availability is not impacted. This scoping suggests improper access control or missing authorization checks on specific HR data operations rather than a full application compromise.

EPSS data reports a probability of 0.24% with a percentile of 15.226 as of 2026-07-23, indicating low predicted exploitation activity at publication. No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at this time.

Root Cause

Oracle has not published detailed root-cause information. Based on the CVSS scope and impact metrics, the issue is consistent with a broken access control or authorization flaw ([CWE-284] class) permitting authenticated users to reach HR data operations outside their intended privilege boundary.

Attack Vector

An authenticated attacker sends HTTP requests to the Oracle E-Business Suite application server. Because privileges required are low, any user with a functional Self-Service Human Resources account can attempt the attack. Successful requests reach Internal Operations functionality that performs unauthorized reads, inserts, updates, or deletes on a subset of HR data.

No verified public exploit code is available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-61075

Indicators of Compromise

Unexpected HTTP requests from low-privileged Self-Service HR user sessions to Internal Operations endpoints
Unauthorized modifications (insert, update, delete) to HR records that do not correlate with legitimate business workflows
Anomalous read access patterns against HR data by accounts without a business need

Detection Strategies

Enable Oracle E-Business Suite audit logging for Self-Service Human Resources and Internal Operations transactions
Correlate application-tier HTTP logs with database audit trails to identify writes performed outside sanctioned workflows
Build behavioral baselines for HR data access per role and alert on deviations, particularly writes from typically read-only accounts

Monitoring Recommendations

Forward Oracle E-Business Suite application, web tier, and database audit logs to a central SIEM for correlation
Monitor for spikes in HTTP 200 responses to HR endpoints from newly created or low-tenure accounts
Track privileged data-change events (INSERT/UPDATE/DELETE) on HR tables and alert on out-of-hours or bulk activity

How to Mitigate CVE-2026-61075

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite 12.2.x as documented in the Oracle Security Alert July 2026
Inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and prioritize internet-exposed instances
Review Self-Service Human Resources user accounts and remove or restrict inactive, over-privileged, or unnecessary accounts

Patch Information

Oracle released fixes for CVE-2026-61075 as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's guidance for applying E-Business Suite 12.2 patches to the affected environments. Consult the Oracle Security Alert July 2026 for patch identifiers and application instructions.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewalls, VPNs, or reverse proxies until patches are applied
Enforce least-privilege on Self-Service Human Resources responsibilities to reduce the population of accounts able to reach the affected component
Increase audit logging and monitoring of Internal Operations transactions during the remediation window

bash

# Verify Oracle E-Business Suite patch level after applying the July 2026 CPU
# Run as the applmgr user on the application tier
sqlplus apps/<password> <<'SQL'
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<PATCH_ID_FROM_CPUJUL2026>')
 ORDER BY last_update_date DESC;
SQL