CVE-2026-61279: Oracle Proposals Auth Bypass Vulnerability

CVE-2026-61279 Overview

CVE-2026-61279 is an information disclosure and data integrity vulnerability in the Oracle Proposals product of Oracle E-Business Suite. The flaw resides in the Proposals component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation permits unauthorized update, insert, or delete operations against a subset of Oracle Proposals data. Attackers can also read a subset of accessible data and trigger a partial denial of service against the Proposals application. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Authenticated network attackers can modify, insert, delete, and read a subset of Oracle Proposals data and cause partial denial of service.

Affected Products

Oracle E-Business Suite — Oracle Proposals version 12.2.3
Oracle E-Business Suite — Oracle Proposals versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Proposals version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61279 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-61279

Vulnerability Analysis

The vulnerability affects the Oracle Proposals component within Oracle E-Business Suite. The attack vector is network-based over HTTP, and the exploit complexity is low. An attacker requires only low-level privileges within the application to trigger the flaw. No user interaction is needed for exploitation to succeed. The scope of impact is limited to the Oracle Proposals component itself and does not cross security boundaries.

Exploitation results in three concurrent outcomes. First, attackers gain unauthorized read access to a subset of Proposals data. Second, they can update, insert, or delete portions of Proposals data without authorization. Third, they can cause a partial denial of service that degrades Proposals availability. The mapping to CWE-200 indicates the primary root cause involves improper exposure of sensitive information to actors who should not have access.

Root Cause

The root cause is improper access control within the Oracle Proposals component of Oracle E-Business Suite. Authorization checks fail to properly restrict low-privileged authenticated users from performing read and write operations on data they should not access. Oracle has not published detailed technical internals of the flaw. Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor guidance.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged application account. The attacker sends crafted HTTP requests to the Proposals component endpoints. Because attack complexity is low and no user interaction is required, exploitation can be scripted against exposed instances. Internet-facing Oracle E-Business Suite deployments face the highest risk.

No public proof-of-concept exploit has been observed for CVE-2026-61279. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the vendor advisory for technical remediation details.

Detection Methods for CVE-2026-61279

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Oracle Proposals URLs and servlets within Oracle E-Business Suite
Anomalous INSERT, UPDATE, or DELETE activity against Proposals database tables initiated by non-administrative application users
Unusual read patterns against Proposals data records outside typical business hours or user roles
Application server errors or availability degradation localized to the Proposals module indicating partial denial-of-service attempts

Detection Strategies

Enable Oracle E-Business Suite audit logging for the Proposals module and capture user identity, timestamp, and record identifiers for all data-modifying operations
Correlate Oracle HTTP Server access logs with application-tier audit records to identify low-privileged accounts issuing sensitive Proposals requests
Deploy database activity monitoring to flag DML operations against Proposals schema objects that deviate from role-based access baselines
Alert on HTTP 5xx error spikes and slow responses from Proposals endpoints that indicate partial denial-of-service conditions

Monitoring Recommendations

Centralize Oracle E-Business Suite application logs, HTTP server logs, and database audit trails in a SIEM for cross-tier correlation
Establish behavioral baselines for each Proposals user role and alert on deviations in access volume, record scope, or modification frequency
Review privileged and low-privileged account activity weekly, focusing on accounts with recent access to the Proposals module

How to Mitigate CVE-2026-61279

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all affected instances running versions 12.2.3 through 12.2.15
Inventory all Oracle E-Business Suite deployments and confirm which environments have the Proposals module installed and enabled
Restrict network access to the Oracle E-Business Suite HTTP interface using firewall rules, VPN, or reverse-proxy allowlists where feasible
Review Proposals module role assignments and remove low-privileged accounts that do not require access to the application

Patch Information

Oracle addressed CVE-2026-61279 in the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, prerequisites, and installation instructions for supported versions 12.2.3 through 12.2.15. Apply the patch in a test environment before production rollout to validate compatibility with customizations.

Workarounds

Disable the Oracle Proposals responsibility for users who do not require it until the patch is deployed
Place the Oracle E-Business Suite front end behind a web application firewall configured to inspect and rate-limit requests to Proposals endpoints
Increase audit logging verbosity on the Proposals module and database schema to enable rapid identification of exploitation attempts pending patch application

bash

# Example: enable Oracle E-Business Suite Sign-On Audit at FORM level
# Set the profile option 'Sign-On:Audit Level' to FORM for tighter session tracking
# (Perform via System Administrator responsibility -> Profile -> System)

# Restrict network exposure of the E-Business Suite HTTP tier at the OS firewall
sudo firewall-cmd --permanent --zone=public --remove-service=http
sudo firewall-cmd --permanent --zone=internal --add-port=8000/tcp
sudo firewall-cmd --reload