CVE-2026-61283: Oracle Bills of Material Auth Bypass Flaw

CVE-2026-61283 Overview

CVE-2026-61283 affects the Oracle Bills of Material product within Oracle E-Business Suite, specifically the Web Services component. The flaw exists in supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation allows unauthorized update, insert, or delete access to a subset of Bills of Material data. Attackers can also gain unauthorized read access to a subset of accessible data and trigger a partial denial of service. Oracle published the fix in its July 2026 Critical Patch Update. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Authenticated attackers with minimal privileges can modify, read, and disrupt Bills of Material data through HTTP-accessible web services, impacting confidentiality, integrity, and availability of manufacturing records.

Affected Products

Oracle E-Business Suite - Oracle Bills of Material 12.2.3
Oracle E-Business Suite - Oracle Bills of Material versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Bills of Material 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61283 published to NVD as part of the Oracle July 2026 Critical Patch Update
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61283

Vulnerability Analysis

The vulnerability resides in the Web Services component of Oracle Bills of Material, a module of Oracle E-Business Suite used to define product structures for manufacturing. Oracle classifies the issue as easily exploitable over the network via HTTP. An authenticated attacker holding low-privilege credentials can send crafted web service requests to manipulate Bills of Material data. The impact spans three dimensions: partial confidentiality loss through unauthorized reads, partial integrity loss through unauthorized inserts, updates, and deletes, and partial availability loss through denial-of-service conditions. The EPSS model reports a probability of 0.249% with percentile 16.341 as of 2026-07-23, indicating limited near-term exploitation activity observed by the model.

Root Cause

The root cause maps to [CWE-284: Improper Access Control]. The affected web services do not sufficiently enforce authorization checks on requests submitted by authenticated users. As a result, low-privileged accounts reach functionality and data that should require higher privileges. The absence of granular access enforcement enables both data modification and information disclosure through the same exposed endpoints.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and valid low-privilege credentials. The attacker submits crafted HTTP requests to Bills of Material web service endpoints. No user interaction is required, and the attack complexity is low. Because the scope is unchanged, the impact is contained within the Bills of Material subsystem. See the Oracle July 2026 Security Alert for vendor-specific technical detail.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in prose only, consistent with Oracle's Critical Patch Update disclosure practices.

Detection Methods for CVE-2026-61283

Indicators of Compromise

Anomalous HTTP requests to Bills of Material web service endpoints originating from low-privileged application accounts.
Unexpected INSERT, UPDATE, or DELETE operations on Bills of Material tables outside of scheduled business processes.
Repeated web service requests generating partial service degradation or elevated response latency on the E-Business Suite application tier.

Detection Strategies

Enable Oracle E-Business Suite audit logging for the Bills of Material module and forward events to a centralized log platform for correlation.
Baseline normal web service call patterns per user role, then alert on deviations that indicate privilege misuse.
Review Oracle HTTP Server access logs for repeated requests to Bills of Material web service URIs from a single session.

Monitoring Recommendations

Monitor database change data capture streams for Bills of Material tables and correlate write activity with the authenticated user identity.
Track failed authorization events and web service HTTP 4xx/5xx response spikes as potential enumeration or DoS indicators.
Alert on new low-privileged accounts accessing Bills of Material APIs that have no prior history of such usage.

How to Mitigate CVE-2026-61283

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite environments running Bills of Material versions 12.2.3 through 12.2.15.
Inventory low-privileged application accounts and disable or rotate credentials for accounts that no longer require Bills of Material access.
Restrict network exposure of the E-Business Suite HTTP tier to trusted internal networks and VPN users only.

Patch Information

Oracle addressed CVE-2026-61283 in the Oracle July 2026 Security Alert. Administrators must apply the Critical Patch Update bundle covering Oracle E-Business Suite 12.2.3 through 12.2.15. Validate the patch in a non-production environment before promotion, then verify successful application through the Oracle AutoPatch logs and the OPatch inventory.

Workarounds

Place a web application firewall in front of the E-Business Suite HTTP tier to filter unauthorized requests to Bills of Material web service paths.
Review Oracle Function Security and Data Security policies to remove excess privileges granted to low-tier application roles.
Where operationally feasible, disable unused Bills of Material web services until the patch can be applied.

bash

# Verify OPatch inventory after applying the July 2026 CPU
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i "July 2026"

# Restrict HTTP tier access at the network layer (example iptables rule)
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP