CVE-2026-61297: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61297 Overview

CVE-2026-61297 is a high-severity vulnerability in the Oracle Customers Online product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can compromise Oracle Customers Online. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Customers Online accessible data. The weakness is categorized under CWE-284 (Improper Access Control).

Critical Impact
Low-privileged authenticated attackers can gain complete read and write access to all Oracle Customers Online data over the network, impacting both confidentiality and integrity of critical business records.

Affected Products

Oracle E-Business Suite – Oracle Customers Online 12.2.3
Oracle E-Business Suite – Oracle Customers Online versions 12.2.4 through 12.2.14
Oracle E-Business Suite – Oracle Customers Online 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61297 published to NVD as part of the Oracle Security Alert July 2026
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61297

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Customers Online, a customer data management module within Oracle E-Business Suite. The flaw allows a low-privileged user with valid credentials to reach functionality or data that should be restricted. Because the attack is delivered over HTTP without user interaction, an authenticated session token is the only precondition. The Exploit Prediction Scoring System (EPSS) currently rates this issue at 0.365%, though EPSS values shift as new intelligence emerges.

Root Cause

The underlying weakness maps to CWE-284, Improper Access Control. Authorization checks in the Internal Operations component fail to correctly restrict actions to entitled users. A request that should be rejected for a low-privileged principal is processed, granting the caller the ability to read and modify Oracle Customers Online data outside of their intended scope.

Attack Vector

An attacker authenticates to Oracle E-Business Suite with any low-privileged account, then issues HTTP requests targeting the vulnerable Internal Operations endpoints of Oracle Customers Online. No social engineering, user interaction, or exploit chaining is required. Because the CVSS scope is unchanged and availability is unaffected, the immediate outcome is data disclosure and tampering rather than denial of service. In enterprise deployments, this can result in the alteration of customer master data, account hierarchies, and related operational records.

No public proof-of-concept code has been released for this vulnerability. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-61297

Indicators of Compromise

Unexpected create, update, or delete operations on customer records in Oracle Customers Online performed by low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user sessions that historically only access read-only screens.
Anomalous spikes in Oracle E-Business Suite application-tier access logs referencing Customers Online modules outside business hours.

Detection Strategies

Enable Oracle E-Business Suite auditing (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for Oracle Customers Online forms and pages.
Correlate application audit records with database-level auditing on customer master tables (HZ_PARTIES, HZ_CUST_ACCOUNTS) to identify modifications lacking a corresponding authorized workflow.
Alert on privilege-to-action mismatches where accounts with limited responsibilities perform administrative-tier operations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized SIEM or data lake for cross-source correlation.
Baseline normal Oracle Customers Online usage per role and alert on statistically significant deviations.
Review Oracle Critical Patch Update advisories on each release cycle and validate that identification content is aligned to newly disclosed Oracle E-Business Suite CVEs.

How to Mitigate CVE-2026-61297

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite environments, including non-production, and confirm patch status against the vendor advisory.
Review responsibilities and roles granted in Oracle Customers Online and remove access for users who do not require it.

Patch Information

Oracle addressed CVE-2026-61297 in the July 2026 Critical Patch Update. Administrators should reference the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and post-installation steps. Patching is the only vendor-supported remediation.

Workarounds

Restrict network access to Oracle E-Business Suite application tiers so that only trusted internal networks and VPN clients can reach HTTP endpoints.
Enforce strong authentication and short session lifetimes to reduce the window in which stolen low-privileged credentials can be reused.
Temporarily disable or restrict access to Oracle Customers Online responsibilities for users who do not require the module until patching is complete.

bash

# Example: verify installed Oracle E-Business Suite patch level
# Run as the applmgr user on the application tier
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_PATCH_ID>')
 ORDER BY last_update_date DESC;
EOF