CVE-2026-61338: Oracle Contracts Auth Bypass Flaw

CVE-2026-61338 Overview

CVE-2026-61338 is a high-severity vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite, within the Internal Operations component. Affected versions span 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this flaw to compromise Oracle Contracts Integration. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Contracts Integration accessible data. The weakness maps to [CWE-284: Improper Access Control].

Critical Impact
An authenticated remote attacker can read and modify all data accessible to Oracle Contracts Integration, resulting in a full confidentiality and integrity compromise of the affected module.

Affected Products

Oracle E-Business Suite — Oracle Contracts Integration version 12.2.3
Oracle E-Business Suite — Oracle Contracts Integration versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Contracts Integration version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61338 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-61338

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Contracts Integration, a module within Oracle E-Business Suite. The vulnerability allows authenticated users with low privileges to bypass intended access controls when interacting with the module over HTTP. Because the attack traverses the network and requires no user interaction, exploitation can be automated across exposed E-Business Suite deployments. The impact covers both confidentiality and integrity of all data reachable through Oracle Contracts Integration, while availability remains unaffected.

Root Cause

The root cause is improper access control [CWE-284] in the Internal Operations component. Authorization checks do not adequately restrict low-privileged users from performing operations reserved for higher-privileged roles. This gap enables horizontal and vertical access to data objects the caller should not be able to read or modify.

Attack Vector

Exploitation requires network access over HTTP and a valid low-privilege account within the E-Business Suite instance. The attacker sends crafted requests to the Contracts Integration Internal Operations endpoints, invoking data operations without the required privilege checks. No user interaction is needed, and the scope remains unchanged. Because Oracle E-Business Suite instances are frequently reachable from internal corporate networks, insider accounts and compromised low-privilege credentials present the primary exploitation path.

No public proof-of-concept code is available. See the Oracle Security Alert - July 2026 for vendor-provided technical guidance.

Detection Methods for CVE-2026-61338

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle Contracts Integration tables performed by low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user accounts that historically do not access the Contracts module.
Audit log entries showing privilege boundary crossings between standard users and contract data objects.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Contracts Integration responsibility.
Correlate database audit trails (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES) with HTTP access logs from the Oracle HTTP Server tier.
Baseline normal Contracts Integration usage patterns and alert on statistical deviations by user, endpoint, or record volume.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web tier logs to a centralized SIEM for cross-tier correlation.
Monitor for bulk data reads or modifications against Contracts Integration objects outside business hours.
Track authentication anomalies for E-Business Suite accounts, including impossible-travel logins and brute-force patterns targeting low-privilege users.

How to Mitigate CVE-2026-61338

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory Contracts Integration user access and revoke unnecessary responsibilities from low-privilege accounts.
Restrict network reachability of the E-Business Suite web tier to trusted corporate ranges and VPN endpoints.

Patch Information

Oracle addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - July 2026 for the applicable patch identifiers and installation instructions for each supported release of E-Business Suite 12.2.

Workarounds

Place the Oracle E-Business Suite web tier behind a web application firewall and enforce authentication on all Contracts Integration URLs.
Reduce the Contracts Integration responsibility footprint by auditing FND_USER_RESP_GROUPS assignments and removing stale grants.
Rotate credentials for low-privileged E-Business Suite accounts and enforce strong password and MFA controls where supported.

bash

# Example: review responsibilities granted to a user in Oracle E-Business Suite
sqlplus apps/<password>@<tns_alias> <<'SQL'
SELECT u.user_name, r.responsibility_name, urg.start_date, urg.end_date
  FROM fnd_user u
  JOIN fnd_user_resp_groups_direct urg ON urg.user_id = u.user_id
  JOIN fnd_responsibility_vl r ON r.responsibility_id = urg.responsibility_id
 WHERE r.responsibility_name LIKE '%Contracts%'
 ORDER BY u.user_name;
SQL