CVE-2026-61112: Oracle Order Management Disclosure Flaw

CVE-2026-61112 Overview

CVE-2026-61112 affects the Product Diagnostic Tools component of Oracle Order Management within Oracle E-Business Suite. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the confidentiality of data managed by Oracle Order Management. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. Supported versions 12.2.3 through 12.2.15 are affected. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker can read all data accessible to Oracle Order Management, exposing sensitive order, customer, and financial records.

Affected Products

Oracle E-Business Suite Order Management 12.2.3
Oracle E-Business Suite Order Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite Order Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61112 published to NVD
2026-07-21 - Last updated in NVD database
Oracle Security Alert reference: Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61112

Vulnerability Analysis

The vulnerability resides in the Product Diagnostic Tools component of Oracle Order Management. The flaw is classified as an information disclosure issue and impacts only the confidentiality of data. Integrity and availability are not affected. Exploitation requires network access over HTTP and an authenticated session with low privileges. No user interaction is required, and the attack complexity is low. Oracle rated the issue as easily exploitable in the July 2026 Critical Patch Update advisory.

Because Order Management processes customer purchase orders, pricing, sales agreements, and shipment data, successful exploitation exposes commercially sensitive records. Attackers who obtain valid low-privilege credentials, for example through phishing or credential reuse, can reach the vulnerable diagnostic endpoints and retrieve data beyond their normal authorization scope.

Root Cause

Oracle has not published detailed root cause information for CVE-2026-61112. Based on the CVSS vector and component name, the flaw resides in the Product Diagnostic Tools code path within Order Management, where access controls on data returned by diagnostic functions do not enforce the caller's authorization boundary. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attacker sends HTTP requests to an internet-reachable or intranet-reachable Oracle E-Business Suite instance. Authentication with a low-privilege account is required. Once authenticated, the attacker invokes the affected diagnostic functionality within Oracle Order Management. The server returns data that the account should not be able to view, including records belonging to other users or organizational units.

No verified proof-of-concept code is publicly available. The EPSS score is 0.355% with a percentile of 28.04, indicating low observed exploitation activity at the time of publication.

Detection Methods for CVE-2026-61112

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite Product Diagnostic Tools URLs from low-privilege user sessions.
Anomalous read volumes from Order Management tables tied to accounts that do not typically query diagnostic endpoints.
Access to Order Management data by user accounts outside of their assigned operating unit or responsibility.

Detection Strategies

Review Oracle E-Business Suite FND_LOG_MESSAGES and web tier access logs for calls to diagnostic servlets and JSPs associated with Order Management.
Correlate authenticated session activity with database audit records for OE_% and ONT_% tables to identify data access that exceeds a user's role.
Baseline normal diagnostic tool usage per user and alert on deviation, particularly requests originating from non-administrative accounts.

Monitoring Recommendations

Enable database auditing for sensitive Order Management schemas and forward events to a centralized SIEM.
Monitor authentication logs for low-privilege accounts that begin issuing diagnostic requests, which may indicate credential misuse.
Track outbound data volumes from EBS application tiers to detect bulk extraction of order data.

How to Mitigate CVE-2026-61112

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle E-Business Suite to all Order Management instances running versions 12.2.3 through 12.2.15.
Inventory all EBS environments, including non-production, and confirm patch level for the Order Management module.
Rotate credentials for any low-privilege EBS accounts suspected of misuse and enforce multi-factor authentication on EBS logins where supported.

Patch Information

Oracle released fixes for CVE-2026-61112 in the July 2026 Critical Patch Update. Administrators should follow the deployment steps described in the Oracle Security Alert July 2026 and validate that Product Diagnostic Tools patches are applied to the Order Management component.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers so that only trusted networks and VPN clients can reach HTTP endpoints.
Remove or minimize responsibilities that grant access to Product Diagnostic Tools for users who do not require them.
Place a web application firewall in front of EBS and block unauthenticated or anomalous requests to diagnostic URLs until patches are applied.

bash

# Example: restrict EBS diagnostic paths at the web tier
# Add to Oracle HTTP Server httpd.conf and reload
<LocationMatch "/OA_HTML/.*[Dd]iagnostic.*">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
</LocationMatch>