CVE-2026-61080: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61080 Overview

CVE-2026-61080 affects the Oracle Public Sector Human Resources product within Oracle E-Business Suite, specifically the Regression Testing component. Supported versions 12.2.3 through 12.2.15 are affected. An authenticated attacker with low privileges and network access via HTTP can exploit this flaw. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of Oracle Public Sector Human Resources data, plus unauthorized read access to a subset of accessible data. Oracle disclosed this issue in the Oracle Security Alert July 2026.

Critical Impact
An authenticated network attacker can tamper with Oracle Public Sector Human Resources records and read a subset of application data through the Regression Testing component.

Affected Products

Oracle E-Business Suite — Oracle Public Sector Human Resources 12.2.3
Oracle E-Business Suite — Oracle Public Sector Human Resources versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Public Sector Human Resources 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61080 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database

Technical Details for CVE-2026-61080

Vulnerability Analysis

The vulnerability resides in the Regression Testing component of Oracle Public Sector Human Resources, part of Oracle E-Business Suite. It is exposed over HTTP and reachable across the network. Exploitation requires an authenticated account with low privileges but no user interaction. A successful attack yields partial confidentiality loss through unauthorized reads and partial integrity loss through unauthorized update, insert, or delete operations. Availability is not impacted, and the scope remains unchanged.

The issue is classified as a broken access control weakness within an authenticated HR workflow. Any low-privilege user who can authenticate to the E-Business Suite front end can invoke functionality that should be restricted to higher-privileged roles.

Root Cause

Oracle has not published a detailed root cause. Based on the advisory, the flaw stems from insufficient authorization enforcement in the Regression Testing component of Oracle Public Sector Human Resources. The component exposes data operations to authenticated sessions that lack the privilege boundary required for HR record modification.

Attack Vector

The attacker authenticates to Oracle E-Business Suite with any low-privileged account. The attacker then issues HTTP requests to Regression Testing endpoints within Oracle Public Sector Human Resources. The endpoints process the requests without validating that the caller holds HR administration privileges. The attacker can read a subset of HR data and modify records through insert, update, or delete operations. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-61080

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Regression Testing URLs originating from low-privileged user sessions.
Unexplained insert, update, or delete activity in Oracle Public Sector Human Resources tables outside normal HR administrator workflows.
Authentication events for low-privilege accounts followed by write activity against HR-owned schemas.

Detection Strategies

Enable Oracle E-Business Suite auditing on Public Sector Human Resources tables and correlate write events with the invoking user role.
Inspect Oracle HTTP Server access logs for calls to Regression Testing endpoints by users outside the HR administrator population.
Establish a baseline of typical Regression Testing usage and alert on deviations in caller identity, request volume, or off-hours activity.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and HTTP server logs to a centralized analytics platform for continuous review.
Monitor privilege usage patterns for low-privileged accounts that interact with HR modules they do not normally access.
Create alerts for anomalous DML activity against Oracle Public Sector Human Resources tables that lacks a corresponding approved change ticket.

How to Mitigate CVE-2026-61080

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory every deployment of Oracle Public Sector Human Resources and confirm patch coverage across production, test, and disaster recovery instances.
Review recent activity in Regression Testing endpoints and HR tables for signs of unauthorized reads or writes.
Enforce least-privilege role assignments and remove unused low-privilege accounts that can authenticate to E-Business Suite.

Patch Information

Oracle addressed CVE-2026-61080 in the July 2026 Critical Patch Update. Administrators should follow the remediation steps documented in the Oracle Security Alert July 2026 and apply the corresponding patches for Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Restrict network access to the Oracle E-Business Suite front end so only authorized internal users and jump hosts can reach HTTP endpoints.
Disable or restrict access to the Regression Testing component until the July 2026 CPU is applied, where operationally feasible.
Tighten responsibility and menu assignments so low-privileged users cannot navigate to Public Sector Human Resources functions.

bash

# Configuration example: verify the applied CPU level on Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number IN ('&july_2026_cpu_bug_id')
 ORDER BY creation_date DESC;
EXIT
EOF