CVE-2026-61116: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61116 Overview

CVE-2026-61116 is an information disclosure vulnerability in the Oracle Application Object Library (FND) component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized access to sensitive data or full read access to all data accessible by Oracle Application Object Library. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can retrieve confidential business data from Oracle E-Business Suite deployments exposed over HTTP without any credentials or user interaction.

Affected Products

Oracle E-Business Suite - Application Object Library 12.2.3 through 12.2.15
Oracle E-Business Suite deployments exposing HTTP endpoints of the FND component
Environments running unpatched July 2026 CPU baselines

Discovery Timeline

2026-07-21 - CVE CVE-2026-61116 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle released fix in the Critical Patch Update (Oracle Critical Patch Update July 2026)

Technical Details for CVE-2026-61116

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Application Object Library (AOL/FND), the framework layer that provides shared services to Oracle E-Business Suite modules. The flaw allows a remote attacker to retrieve confidential data handled by the library. Oracle classifies the issue as easily exploitable, meaning no specialized conditions are required beyond reaching the affected HTTP endpoint.

The scope is unchanged, so the compromise is limited to resources managed by the vulnerable component. However, because Application Object Library brokers access across modules such as Financials, Human Resources, and Supply Chain, the reachable data set can span multiple business domains. Integrity and availability are not impacted; the vulnerability is purely a confidentiality issue.

The EPSS probability of 0.303% reflects current, not future, exploitation likelihood. Oracle E-Business Suite has historically been a target for opportunistic scanning after CPU disclosures, so exposure windows should be minimized.

Root Cause

Oracle has not published detailed technical internals. Based on the CVSS profile of network access, no privileges, no user interaction, and confidentiality-only impact, the underlying defect is consistent with an information exposure weakness in an HTTP-facing FND servlet or endpoint that returns data without enforcing authentication or authorization checks.

Attack Vector

An attacker sends crafted HTTP requests to the exposed Oracle Application Object Library endpoint. No credentials, tokens, or user interaction are required. The response returns data the attacker should not be authorized to view. Internet-exposed E-Business Suite portals and improperly segmented internal deployments are the primary risk surfaces.

No public proof-of-concept exploit or CISA KEV listing is associated with this CVE at the time of publication. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-specific detail.

Detection Methods for CVE-2026-61116

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle E-Business Suite /OA_HTML/ and FND-related URIs from external or unexpected internal sources
Large or repeated responses returned to sessions that never completed authentication against the E-Business Suite login flow
Access log entries showing anomalous query strings targeting Application Object Library servlets

Detection Strategies

Correlate web server access logs with authentication logs to identify HTTP 200 responses to FND endpoints without a preceding successful login
Baseline normal traffic to Oracle E-Business Suite HTTP tiers and alert on volumetric spikes from single source IPs
Deploy web application firewall rules to flag or block unauthenticated access attempts against Application Object Library paths

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and database audit logs to a centralized analytics platform for retention and correlation
Monitor egress traffic from the E-Business Suite mid-tier for unusual data volumes indicative of bulk extraction
Track patch level of each E-Business Suite instance and alert on drift from the July 2026 CPU baseline

How to Mitigate CVE-2026-61116

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15
Restrict internet exposure of Oracle E-Business Suite HTTP endpoints to VPN or trusted network ranges until patching is complete
Review web server access logs from the disclosure date forward for signs of unauthenticated data access

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should download the applicable patch for their E-Business Suite version from My Oracle Support and follow the readme instructions. See the Oracle Critical Patch Update July 2026 advisory for full patch identifiers and prerequisites.

Workarounds

Place the E-Business Suite mid-tier behind a reverse proxy or WAF that enforces authentication on Application Object Library URIs
Apply network ACLs restricting inbound HTTP access to the FND endpoints to known administrative networks
Disable or firewall-block any FND servlet paths not required for business operations pending patch deployment

bash

# Example: restrict inbound HTTP access to E-Business Suite tier with iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP