CVE-2026-61138: Oracle E-Business Suite Auth Bypass Issue

CVE-2026-61138 Overview

CVE-2026-61138 is a high-severity vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise the application, though exploitation requires overcoming high attack complexity. Successful exploitation results in unauthorized access to critical data and limited unauthorized modification of accessible data. The scope-changing nature of the flaw means attacks may extend impact beyond the vulnerable component to additional Oracle products.

Critical Impact
Unauthenticated network attackers can gain complete access to all data accessible by Oracle Complex Maintenance, Repair and Overhaul, with scope-changing impact affecting additional Oracle products.

Affected Products

Oracle E-Business Suite - Oracle Complex Maintenance, Repair and Overhaul version 12.2.3
Oracle E-Business Suite - Oracle Complex Maintenance, Repair and Overhaul versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Complex Maintenance, Repair and Overhaul version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61138 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61138

Vulnerability Analysis

The vulnerability affects the Internal Operations component of the Oracle Complex Maintenance, Repair and Overhaul (cMRO) product within Oracle E-Business Suite. Oracle's advisory characterizes the flaw as difficult to exploit but reachable over the network without authentication or user interaction. Successful exploitation yields high confidentiality impact and low integrity impact, with no direct availability impact.

The scope change indicates that a compromise in the vulnerable component can affect resources managed by other components or products in the Oracle E-Business Suite stack. This behavior typically arises when the vulnerable component executes with privileges or trust relationships that extend to shared subsystems such as authentication contexts, session stores, or the underlying database.

EPSS data reports a low near-term exploitation probability, and no public proof-of-concept, exploit code, or CISA KEV listing is available at the time of publication.

Root Cause

Oracle has not publicly disclosed the underlying weakness class or CWE mapping for CVE-2026-61138. Based on the CVSS metrics, the flaw is reachable through HTTP requests to the cMRO Internal Operations component and does not require credentials or user interaction. The high attack complexity suggests specific conditions or non-default state must be present for reliable exploitation.

Attack Vector

An attacker sends crafted HTTP traffic to an exposed Oracle E-Business Suite instance running an affected cMRO version. Because authentication is not required, any network-reachable deployment is in scope, including installations behind reverse proxies that do not enforce authentication at the perimeter. The scope change indicates the attack can pivot beyond cMRO to impact other Oracle E-Business Suite modules sharing the same runtime context.

No verified exploit code is publicly available. Refer to the Oracle Critical Patch Update July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-61138

Indicators of Compromise

Unauthenticated HTTP requests targeting Oracle Complex Maintenance, Repair and Overhaul URIs and Internal Operations endpoints from external or unexpected internal sources.
Unusual database queries or data export activity originating from the Oracle E-Business Suite application tier outside normal business workflows.
Anomalous session creation or privilege usage in Oracle E-Business Suite audit logs tied to cMRO modules.

Detection Strategies

Monitor Oracle HTTP Server and WebLogic access logs for repeated or malformed requests to cMRO paths.
Correlate application-tier requests with database audit trails to identify request patterns that access sensitive tables without a corresponding authenticated session.
Baseline normal cMRO traffic volume and alert on statistically significant deviations, particularly from non-corporate IP ranges.

Monitoring Recommendations

Enable and centralize Oracle E-Business Suite FND_LOG_MESSAGES and Oracle HTTP Server access logs in a SIEM for retention and correlation.
Track outbound data volumes from the Oracle E-Business Suite application server to detect potential exfiltration following exploitation.
Alert on new administrative or scheduled program submissions in Oracle E-Business Suite that originate from cMRO workflows outside change windows.

How to Mitigate CVE-2026-61138

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running cMRO versions 12.2.3 through 12.2.15.
Inventory external and internal exposure of Oracle E-Business Suite HTTP endpoints and restrict access to trusted networks pending patch deployment.
Review Oracle HTTP Server and database audit logs for prior indicators of unauthorized access to cMRO data.

Patch Information

Oracle addressed CVE-2026-61138 in the Oracle Critical Patch Update July 2026. Administrators must apply the patch bundle appropriate to their Oracle E-Business Suite 12.2 codeline. Verify patch application by consulting Oracle Support Note references included in the advisory and by confirming version metadata post-installation.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewall rules or reverse-proxy allow-lists limited to known corporate ranges.
Enforce authentication at the perimeter using an SSO or WAF layer to block unauthenticated requests to cMRO paths.
Disable or unmap unused cMRO Internal Operations functions where operationally feasible until patching completes.

bash

# Example: restrict access to Oracle E-Business Suite HTTP endpoints at the reverse proxy
# nginx snippet — allow only trusted corporate ranges to reach cMRO paths
location ~* ^/OA_HTML/.*(cMRO|CMRO|MaintenanceRepair) {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://ebs_app_tier;
}