CVE-2026-61287: Oracle Process Manufacturing Auth Bypass

CVE-2026-61287 Overview

CVE-2026-61287 is an access control vulnerability [CWE-284] in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite, within the Internal Operations component. Affected supported versions span 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue to compromise Oracle Process Manufacturing Systems. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle Process Manufacturing Systems accessible data.

Critical Impact
Authenticated remote attackers can read, modify, or delete all data accessible to Oracle Process Manufacturing Systems, undermining the integrity and confidentiality of manufacturing workflows.

Affected Products

Oracle E-Business Suite — Oracle Process Manufacturing Systems 12.2.3
Oracle E-Business Suite — Oracle Process Manufacturing Systems 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Process Manufacturing Systems 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61287 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61287

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Process Manufacturing Systems, part of Oracle E-Business Suite. Oracle categorizes the issue as easily exploitable over the network via HTTP by an attacker holding only low-level privileges. No user interaction is required for exploitation. The confidentiality and integrity impacts extend to all data accessible to Oracle Process Manufacturing Systems, while availability is not affected. Because the scope remains unchanged, the impact is confined to the vulnerable Oracle Process Manufacturing Systems instance rather than pivoting to other security authorities.

Root Cause

Oracle's advisory maps the weakness to [CWE-284] Improper Access Control. The application fails to correctly enforce authorization checks on requests handled by the Internal Operations component. Authenticated users receive access to functionality or data that should be restricted based on their assigned roles.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. An attacker submits crafted HTTP requests to Internal Operations endpoints exposed by Oracle Process Manufacturing Systems. Because the missing authorization check permits both read and write operations, the attacker can enumerate sensitive manufacturing data and issue create, update, or delete calls against records outside the account's intended scope. See the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-61287

Indicators of Compromise

Unexpected create, update, or delete operations performed by low-privileged Oracle E-Business Suite accounts against Oracle Process Manufacturing Systems records.
HTTP request bursts targeting Internal Operations endpoints from a single authenticated session.
Audit log entries showing access to Process Manufacturing data outside the user's assigned organization or responsibility.

Detection Strategies

Enable and forward Oracle E-Business Suite audit trails and Oracle Process Manufacturing Systems module logs to a centralized log platform for correlation.
Alert on privilege-to-action mismatches, such as low-privileged responsibilities invoking Internal Operations write functions.
Baseline normal HTTP request patterns per user and flag deviations against Oracle Process Manufacturing URLs.

Monitoring Recommendations

Monitor authentication events for Oracle E-Business Suite accounts, focusing on accounts with minimal responsibilities that generate unusual query volumes.
Track changes to critical Process Manufacturing tables and reconcile them against approved change tickets.
Review Oracle HTTP Server access logs for repeated 200 responses to Internal Operations endpoints originating from non-administrative users.

How to Mitigate CVE-2026-61287

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update referenced by the Oracle Security Alert July 2026 to every Oracle E-Business Suite instance running versions 12.2.3 through 12.2.15.
Inventory all Oracle Process Manufacturing Systems deployments and confirm patch status against Oracle's advisory.
Audit low-privileged account activity for signs of unauthorized data access or modification prior to patching.

Patch Information

Oracle addressed CVE-2026-61287 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and application instructions specific to Oracle E-Business Suite 12.2.x.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so that only trusted internal networks and VPN clients can reach Oracle Process Manufacturing Systems.
Review and tighten Oracle E-Business Suite responsibilities and menu exclusions to remove Internal Operations functions from users who do not require them.
Rotate credentials for low-privileged Oracle E-Business Suite accounts and enforce multi-factor authentication where supported until patching is complete.

bash

# Example: restrict inbound HTTP access to Oracle E-Business Suite
# to trusted management subnets pending patch deployment
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP