CVE-2026-61113: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61113 Overview

CVE-2026-61113 is a high-severity vulnerability in the Oracle Application Object Library (AOL) component of Oracle E-Business Suite. The flaw affects the Core module across supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can compromise the Application Object Library. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with read access to all Application Object Library accessible data. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Remote, unauthenticated attackers can read and modify critical business data stored in Oracle E-Business Suite deployments, impacting confidentiality and integrity across affected environments.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Application Object Library (Core component)
Deployments exposing Oracle E-Business Suite HTTP endpoints to untrusted networks

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory
2026-07-21 - CVE-2026-61113 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61113

Vulnerability Analysis

The vulnerability resides in the Core component of the Oracle Application Object Library, the shared framework layer used by Oracle E-Business Suite modules for authentication, session management, and data access. An attacker sends crafted HTTP requests to an exposed E-Business Suite endpoint. No credentials, tokens, or user interaction are required to reach the vulnerable code path.

Exploitation is rated as high complexity. The attacker must satisfy specific preconditions or timing constraints to reliably trigger the flaw. Once triggered, the attacker gains full read access to data managed by the Application Object Library. The attacker can also create, delete, or modify records in that data set. Availability is not affected. The EPSS probability is 0.318% (percentile 24.059) as of 2026-07-23.

Root Cause

Oracle has not published implementation-level details. The advisory describes the impact as unauthorized data access and modification through an HTTP-facing interface exposed by the Application Object Library Core. See the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires reachability to the E-Business Suite web tier but no prior authentication. No user interaction is required. Attacks target the same security scope as the vulnerable component and do not cross a trust boundary. Because verified proof-of-concept code is not public, the vulnerability is described in prose only.

// No verified public exploit code is available for CVE-2026-61113.
// Refer to the Oracle Security Alert July 2026 for vendor guidance:
// https://www.oracle.com/security-alerts/cpujul2026.html

Detection Methods for CVE-2026-61113

Indicators of Compromise

Unauthenticated HTTP requests to Oracle E-Business Suite endpoints originating from external or untrusted networks
Anomalous INSERT, UPDATE, or DELETE operations against Application Object Library tables outside of scheduled batch windows
Unexpected creation or modification of Application Object Library records without a corresponding user session
Web tier access logs showing repeated requests to Core AOL URIs from a single source

Detection Strategies

Correlate Oracle HTTP Server access logs with FND (Foundation) audit tables to identify data changes lacking an authenticated session context
Enable and monitor Oracle E-Business Suite Sign-On Audit and page access tracking to surface anonymous flows reaching AOL Core
Deploy web application firewall rules to flag HTTP requests to Oracle E-Business Suite endpoints that bypass the login servlet

Monitoring Recommendations

Alert on database audit events touching FND_USER, FND_RESPONSIBILITY, and other AOL-managed tables from non-application accounts
Baseline outbound and inbound HTTP traffic to E-Business Suite hosts and alert on deviations
Monitor for new administrative or responsibility assignments created outside of change control windows

How to Mitigate CVE-2026-61113

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15
Restrict network exposure of the E-Business Suite web tier to trusted networks and VPN users only
Audit Application Object Library data for unauthorized changes since the patch window
Rotate credentials and API tokens issued by the affected E-Business Suite instance if compromise is suspected

Patch Information

Oracle addressed CVE-2026-61113 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the specific patch identifiers applicable to each E-Business Suite release. Apply patches following Oracle's documented pre-production testing and rollback procedures.

Workarounds

Place the Oracle E-Business Suite web tier behind a reverse proxy or WAF that enforces authentication before requests reach AOL Core
Disable or firewall off any AOL Core HTTP endpoints not required for business operations
Limit inbound HTTP access to allow-listed corporate IP ranges until patching is complete

bash

# Example: restrict inbound HTTP access to the E-Business Suite web tier
# using iptables until the July 2026 CPU patches are applied
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP