CVE-2026-61309: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-61309 Overview

CVE-2026-61309 affects the Oracle In-Memory Cost Management for Discrete Industries product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. An unauthenticated attacker with network access via HTTP can exploit this weakness to gain unauthorized read access to all data accessible to the affected product. Oracle addressed the issue in the July 2026 Critical Patch Update. The Common Weakness Enumeration classification is [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can obtain complete access to confidential business data managed by Oracle In-Memory Cost Management for Discrete Industries.

Affected Products

Oracle E-Business Suite — Oracle In-Memory Cost Management for Discrete Industries 12.2.3
Oracle E-Business Suite — Oracle In-Memory Cost Management for Discrete Industries versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle In-Memory Cost Management for Discrete Industries 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61309 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61309

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle In-Memory Cost Management for Discrete Industries, a module of Oracle E-Business Suite used for costing operations in manufacturing environments. The vulnerability permits an unauthenticated actor communicating over HTTP to reach data that the application should restrict to authorized users. Successful exploitation results in unauthorized read access to sensitive cost, financial, and operational records. Integrity and availability are not affected, but confidentiality impact is high because the attacker can retrieve the full data set accessible to the product.

Root Cause

The issue is categorized as [CWE-284] Improper Access Control. The affected component fails to enforce authentication and authorization checks before serving requests to specific HTTP endpoints. As a result, a request that would normally require a valid session is processed without verifying the caller's identity or entitlements.

Attack Vector

The attack vector is network based and does not require credentials, user interaction, or elevated privileges. An attacker sends crafted HTTP requests to the exposed Oracle E-Business Suite endpoints hosting the In-Memory Cost Management for Discrete Industries application. Internet-facing deployments are the highest-risk targets. The EPSS score is 0.398% at the 32.339 percentile as of 2026-07-22, indicating limited observed exploitation activity at publication time.

No verified proof-of-concept code is publicly available. Refer to the Oracle Critical Patch Update Advisory for authoritative technical details.

Detection Methods for CVE-2026-61309

Indicators of Compromise

Unauthenticated HTTP requests to Oracle E-Business Suite endpoints associated with the In-Memory Cost Management for Discrete Industries module.
Anomalous outbound data transfers or bulk responses from the Oracle E-Business Suite application tier following requests without valid session cookies.
Access log entries showing requests to Internal Operations URIs from source IPs that never completed authentication.

Detection Strategies

Inspect Oracle HTTP Server and Oracle Application Server access logs for requests to In-Memory Cost Management URIs missing session identifiers or Authorization headers.
Correlate web application firewall telemetry with backend response sizes to flag high-volume data retrieval by unauthenticated sources.
Deploy signatures on network sensors to identify HTTP GET or POST patterns targeting affected Internal Operations endpoints on Oracle E-Business Suite 12.2.x.

Monitoring Recommendations

Enable verbose HTTP access logging on the Oracle E-Business Suite application tier and forward logs to a centralized analytics platform.
Alert on unexpected requests to In-Memory Cost Management endpoints originating from external networks.
Baseline normal request volumes for Internal Operations URIs and trigger alerts on statistical deviations.

How to Mitigate CVE-2026-61309

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory internet-exposed Oracle E-Business Suite deployments and restrict In-Memory Cost Management endpoints to trusted networks until patched.
Review historical HTTP access logs for signs of prior unauthenticated access to affected URIs.

Patch Information

Oracle released fixes for CVE-2026-61309 in the July 2026 Critical Patch Update. Consult the Oracle Critical Patch Update Advisory for patch identifiers and installation guidance specific to each supported release of Oracle E-Business Suite 12.2.x.

Workarounds

Restrict network access to the Oracle E-Business Suite application tier using firewall rules, permitting only authenticated internal traffic.
Place a web application firewall in front of Oracle E-Business Suite and block unauthenticated requests to Internal Operations paths.
Disable or unmap the In-Memory Cost Management for Discrete Industries module if it is not required for business operations.

bash

# Configuration example: restrict access at the reverse proxy
# Example Apache httpd rule blocking unauthenticated access to affected paths
<LocationMatch "/OA_HTML/.*CostManagement.*">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>