CVE-2026-61221: Oracle Item Master Auth Bypass Vulnerability

CVE-2026-61221 Overview

CVE-2026-61221 affects the Oracle Item Master product within Oracle E-Business Suite, specifically the iSet-up bugs component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Item Master. Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle Item Master accessible data, along with unauthorized read access to a subset of that data. The vulnerability is classified under CWE-284 (Improper Access Control).

Critical Impact
An authenticated attacker over the network can modify and read Oracle Item Master data, impacting the integrity and confidentiality of item master records used across Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite – Oracle Item Master, version 12.2.3
Oracle E-Business Suite – Oracle Item Master, versions 12.2.4 through 12.2.14
Oracle E-Business Suite – Oracle Item Master, version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-61221 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61221

Vulnerability Analysis

The vulnerability resides in the iSet-up bugs component of Oracle Item Master, part of Oracle E-Business Suite. An attacker holding low-privileged credentials can send crafted HTTP requests to reach affected endpoints without additional user interaction. The weakness enables partial modification and partial disclosure of Oracle Item Master data. Availability is not impacted, but integrity and confidentiality are both affected within a limited data scope.

Item Master data underpins procurement, manufacturing, and inventory workflows in Oracle E-Business Suite. Unauthorized inserts, updates, or deletes to this dataset can propagate downstream, corrupting item definitions and related business processes. The issue is mapped to CWE-284, Improper Access Control.

Root Cause

The root cause is improper access control in the iSet-up bugs component. Authorization checks fail to restrict low-privileged authenticated users from performing operations reserved for higher-privileged roles. As a result, requests that should be rejected are processed against Item Master records.

Attack Vector

Exploitation requires network access via HTTP and authenticated low-privilege credentials to the Oracle E-Business Suite instance. No user interaction is required. The attacker sends HTTP requests targeting the affected iSet-up bugs endpoints to read or manipulate Item Master data.

No public proof-of-concept code is available. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-provided technical context.

Detection Methods for CVE-2026-61221

Indicators of Compromise

Unexpected create, update, or delete operations on Oracle Item Master records originating from low-privileged application accounts.
HTTP requests to Oracle E-Business Suite iSet-up endpoints from user accounts that do not typically interact with item setup functionality.
Anomalous read access patterns against Item Master data outside of normal business hours or from atypical sessions.

Detection Strategies

Enable and review Oracle E-Business Suite audit logs (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for iSet-up bugs component activity.
Correlate application-tier HTTP access logs with database changes to Item Master tables to identify unauthorized modifications.
Baseline normal Item Master transaction volumes per user role and alert on deviations, particularly from low-privileged accounts.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit events to a centralized SIEM for continuous review.
Monitor authentication events for low-privileged accounts that suddenly access iSet-up functionality.
Track schema-level changes to Item Master tables using database activity monitoring or Oracle audit policies.

How to Mitigate CVE-2026-61221

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Review responsibilities and role assignments in Oracle E-Business Suite to ensure least-privilege access to Item Master and iSet-up functions.
Rotate credentials for any low-privileged accounts suspected of misuse after applying the patch.

Patch Information

Oracle released fixes for this vulnerability in the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented patch application procedure for E-Business Suite 12.2.x, including running adop in hotpatch or standard patching mode as appropriate, and validating post-patch functionality in a non-production environment first.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so only trusted internal networks and VPN users can reach them.
Temporarily remove or tighten responsibilities that grant access to the iSet-up bugs component for non-administrative users until patches are applied.
Enable enhanced auditing on Item Master tables to detect and reverse unauthorized changes while remediation is pending.

bash

# Example: verify installed Oracle E-Business Suite patch level after CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF