CVE-2026-61333: Oracle Product Workbench Auth Bypass Flaw

CVE-2026-61333 Overview

CVE-2026-61333 is an access control vulnerability in the Oracle Product Workbench component of Oracle E-Business Suite. The flaw resides in the Internal Operations subcomponent and affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access over HTTP can exploit this weakness to read, create, modify, or delete data accessible to Oracle Product Workbench. The vulnerability is classified under CWE-284: Improper Access Control and impacts both confidentiality and integrity. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
A low-privileged authenticated attacker can compromise all data accessible to Oracle Product Workbench, enabling unauthorized read and write access to critical business information.

Affected Products

Oracle E-Business Suite — Oracle Product Workbench version 12.2.3
Oracle E-Business Suite — Oracle Product Workbench versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Product Workbench version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61333 published to the National Vulnerability Database
2026-07-22 - Last updated in the NVD database

Technical Details for CVE-2026-61333

Vulnerability Analysis

CVE-2026-61333 is an improper access control weakness in the Internal Operations component of Oracle Product Workbench. The affected code path fails to enforce sufficient authorization checks when handling HTTP requests from authenticated users. As a result, users holding only low-privilege accounts can invoke functionality that should be restricted to higher-privileged roles.

Exploitation is described by Oracle as easily achievable, requiring only network access via HTTP and valid credentials. The scope remains unchanged, meaning the attack affects resources managed by the same security authority as the vulnerable component. Both confidentiality and integrity are fully impacted, while availability is not affected.

Root Cause

The root cause is missing or insufficient authorization enforcement on Internal Operations endpoints within Oracle Product Workbench. Requests that should validate the caller's role and data ownership proceed without adequate checks, allowing lateral and vertical access to Product Workbench data.

Attack Vector

An attacker authenticates to the Oracle E-Business Suite instance with any low-privileged account. The attacker then issues crafted HTTP requests to the Product Workbench Internal Operations interface. Because the affected endpoints do not properly enforce access control, the attacker can enumerate, read, create, modify, or delete records belonging to the Product Workbench dataset. No user interaction is required, and no elevated privileges are needed beyond initial authentication.

No verified public exploit code or proof-of-concept is available for this vulnerability. Refer to the Oracle Critical Patch Update July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-61333

Indicators of Compromise

Unexpected HTTP requests to Oracle Product Workbench Internal Operations endpoints originating from low-privileged user sessions.
Anomalous create, update, or delete operations against Product Workbench records outside standard business workflows.
Sudden increases in Product Workbench data access volume from a single authenticated session.

Detection Strategies

Enable Oracle E-Business Suite application-level auditing for Product Workbench modules and review access to Internal Operations functions.
Correlate web server access logs with EBS user session data to identify low-privileged accounts accessing sensitive Product Workbench URLs.
Baseline normal Product Workbench transaction patterns per role and alert on deviations, particularly unauthorized data modification events.

Monitoring Recommendations

Forward Oracle E-Business Suite audit trails, FND_LOG_MESSAGES, and Apache/Oracle HTTP Server access logs to a centralized SIEM.
Monitor for repeated HTTP 200 responses on Product Workbench endpoints from accounts that historically do not use those functions.
Track privilege usage against role definitions and flag accounts accessing Internal Operations data outside their assigned responsibilities.

How to Mitigate CVE-2026-61333

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.x environments running Product Workbench.
Inventory all low-privileged EBS accounts and review recent access to Product Workbench Internal Operations functions.
Enforce strong authentication, including MFA where supported, to reduce the risk of credential-based access to EBS.

Patch Information

Oracle released fixes for CVE-2026-61333 as part of the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented patch application process for E-Business Suite 12.2 and validate the patch level after deployment. No supported workaround replaces applying the vendor patch.

Workarounds

Restrict network access to the E-Business Suite application tier so that only trusted internal networks and VPN users can reach Product Workbench URLs.
Review and tighten responsibility and menu assignments in EBS to minimize the number of accounts with any level of Product Workbench access until patching is complete.
Increase logging verbosity on Product Workbench modules to support post-incident forensic review pending patch deployment.

bash

# Verify the Oracle E-Business Suite patch level after applying CPU July 2026
# Run as the applmgr user on the EBS application tier
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF