CVE-2026-61125: Oracle Configure to Order Auth Bypass

CVE-2026-61125 Overview

CVE-2026-61125 affects the Oracle Configure to Order product within Oracle E-Business Suite, specifically the Supply to Order Workbench component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise Oracle Configure to Order. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. The scope-changing nature of the flaw means attacks may significantly impact additional Oracle products beyond Configure to Order.

Critical Impact
A low-privileged, network-based attacker can access sensitive Oracle E-Business Suite data across multiple components due to a scope-changing confidentiality flaw.

Affected Products

Oracle E-Business Suite - Oracle Configure to Order 12.2.3
Oracle E-Business Suite - Oracle Configure to Order 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Configure to Order 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61125 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-61125

Vulnerability Analysis

The vulnerability resides in the Supply to Order Workbench component of Oracle Configure to Order. An authenticated attacker with low privileges can send crafted HTTP requests to the affected component and gain unauthorized read access to sensitive data. The flaw exhibits a scope change, meaning exploitation impacts resources beyond the vulnerable component itself.

The impact is limited to confidentiality. Integrity and availability of the target system are not directly affected. However, exposure of business-critical order, supply chain, and manufacturing data across integrated Oracle E-Business Suite modules represents significant risk to enterprise operations.

Root Cause

Oracle has not published detailed technical root-cause information in the public advisory. The vendor advisory indicates the issue exists in the Supply to Order Workbench component and that authentication with low privileges is sufficient to trigger the flaw. The scope change classification indicates that a security boundary within Oracle E-Business Suite is crossed during exploitation, exposing data owned by adjacent components.

Attack Vector

Attackers exploit the vulnerability remotely over HTTP. The attacker must possess valid low-privileged credentials for the Oracle E-Business Suite instance. No user interaction is required. Exploitation complexity is low, making the flaw suitable for opportunistic use by insiders or attackers who have already obtained low-tier credentials through phishing, credential stuffing, or prior compromise. Refer to the Oracle Security Alert July 2026 for authoritative details.

Detection Methods for CVE-2026-61125

Indicators of Compromise

Unusual HTTP requests from low-privileged Oracle E-Business Suite user accounts targeting Supply to Order Workbench endpoints.
Access to Configure to Order data by accounts that do not typically interact with supply chain or order management workflows.
Anomalous data retrieval volumes or off-hours queries against Oracle E-Business Suite application tiers.

Detection Strategies

Enable and review Oracle E-Business Suite audit logs for the Configure to Order module, focusing on Supply to Order Workbench actions.
Correlate application-tier HTTP access logs with database access patterns to identify scope-crossing data reads.
Baseline normal user activity per role and alert on deviations involving cross-module data access.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized SIEM for retention and analysis.
Monitor for successful authentications from unexpected geographic locations or IP ranges accessing Configure to Order URLs.
Track privilege usage and flag low-privileged accounts accessing high-value data sets.

How to Mitigate CVE-2026-61125

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all Configure to Order deployments and confirm patch status against the Oracle Security Alert July 2026.
Audit low-privileged accounts and revoke unnecessary access to Configure to Order components.
Rotate credentials for accounts that may have interacted with the Supply to Order Workbench prior to patching.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should download and apply the relevant patches for Oracle E-Business Suite 12.2.x. Consult the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and installation guidance.

Workarounds

Restrict network access to Oracle E-Business Suite application tiers using firewall rules, VPN gating, or reverse proxy allowlists.
Disable or restrict access to the Supply to Order Workbench functionality for user roles that do not require it.
Enforce multi-factor authentication for all Oracle E-Business Suite users to reduce risk of low-privileged credential abuse.

bash

# Configuration example - restrict access to Configure to Order URLs at the reverse proxy layer
# Apache httpd example
<Location /OA_HTML/OA.jsp>
    Require ip 10.0.0.0/8
    Require valid-user
</Location>