CVE-2026-61266: Oracle E-Business Suite SQLi Vulnerability

CVE-2026-61266 Overview

CVE-2026-61266 affects the Oracle Supply Chain Globalization product within Oracle E-Business Suite, specifically the Copy Inventory Organization component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability is classified under [CWE-89] (SQL Injection) and allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation leads to unauthorized update, insert, or delete access to a subset of accessible data, unauthorized read access to some data, and partial denial of service.

Critical Impact
Authenticated attackers can manipulate data and cause partial service disruption in Oracle Supply Chain Globalization deployments running versions 12.2.3 to 12.2.15.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Supply Chain Globalization (Copy Inventory Organization component)
Deployments exposing Oracle E-Business Suite HTTP endpoints to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-61266 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update / Security Alert July 2026

Technical Details for CVE-2026-61266

Vulnerability Analysis

The vulnerability resides in the Copy Inventory Organization component of Oracle Supply Chain Globalization. The flaw is categorized as SQL Injection under [CWE-89]. An authenticated attacker with low privileges can send crafted HTTP requests that manipulate database query construction inside the component. The exploitation path does not require user interaction and can be triggered remotely over the network.

Successful attacks impact confidentiality, integrity, and availability. Attackers gain read access to a subset of application data, can update, insert, or delete records in accessible tables, and can trigger a partial denial of service against the affected module. The Exploit Prediction Scoring System (EPSS) score for this issue is 0.196%, reflecting relatively low observed exploitation likelihood at publication.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands within the Copy Inventory Organization functionality. User-supplied input reaches SQL statement construction without adequate parameterization or sanitization. This allows an authenticated user to alter query semantics.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. The attacker submits a crafted request to the Copy Inventory Organization workflow. The injected SQL syntax executes within the application's database context, yielding data manipulation and information disclosure. Refer to the Oracle Security Alert July 2026 for authoritative technical detail.

Detection Methods for CVE-2026-61266

Indicators of Compromise

HTTP requests targeting Copy Inventory Organization endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences (--, /*).
Database audit records showing unexpected INSERT, UPDATE, or DELETE operations initiated by low-privileged application accounts.
Application error logs referencing malformed SQL statements originating from the Supply Chain Globalization module.

Detection Strategies

Enable Oracle Database fine-grained auditing on tables accessed by the Copy Inventory Organization component and alert on anomalous DML.
Deploy a web application firewall in front of Oracle E-Business Suite with signatures for SQL injection patterns targeting /OA_HTML/ paths.
Correlate authenticated session identifiers with sudden increases in query volume or query error rates from the affected module.

Monitoring Recommendations

Forward Oracle E-Business Suite access logs, database audit logs, and WAF logs to a centralized SIEM for correlation.
Baseline normal request patterns for Copy Inventory Organization and alert on deviations in parameter length, character sets, or request frequency.
Review privileged and low-privileged application account activity for lateral changes to inventory organization records.

How to Mitigate CVE-2026-61266

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 instances without delay.
Inventory all Oracle E-Business Suite deployments and confirm the patch level of the Supply Chain Globalization module.
Restrict network access to Oracle E-Business Suite HTTP endpoints so only trusted internal users and networks can reach the application tier.
Audit low-privileged application accounts and disable or rotate credentials for unused or dormant users.

Patch Information

Oracle released fixes as part of the Critical Patch Update in July 2026. Administrators must download and apply the patch bundle referenced in the Oracle Security Alert July 2026. Oracle recommends applying Critical Patch Updates without delay because unpatched systems have been repeatedly targeted by attackers.

Workarounds

Restrict access to the Copy Inventory Organization function through Oracle E-Business Suite responsibilities and menus until patching is complete.
Place the application behind a web application firewall configured to block SQL injection payloads in HTTP parameters.
Enable database-side auditing on tables used by Supply Chain Globalization to detect and investigate suspicious modifications.

bash

# Verify Oracle E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF