CVE-2026-60770
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker with network access via HTTP to take over the application object library.
Risk Assessment
Successful attack can lead to full takeover of the object library, compromising confidentiality, integrity, and availability of all dependent applications.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15 immediately and implement network segmentation.
Other vulnerabilities in Oracle Application Object Library
See all- CVE-2017-10328High
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Affected versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
- CVE-2026-60773Critical
Vulnerability in Oracle Application Object Library (Core component) allows a low-privileged attacker via HTTPS to unauthorizedly create, delete, or modify critical data and gain full access to all data. Attacks may impact additional products (scope change).
- CVE-2026-61116High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Easily exploitable, allows an unauthenticated attacker via HTTP to gain unauthorized access to all library data.
- CVE-2026-61114High
Vulnerability in Oracle Application Object Library (component: DB Privileges) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to compromise the system.
- CVE-2026-61113High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modify critical data.
- CVE-2026-61111Medium
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. A low-privileged attacker with local access can easily exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all Oracle Application Object Library data. The attack may impact other products.
- CVE-2026-60776Medium
Vulnerability in Oracle Application Object Library (component: AOL Generic Loader) versions 12.2.3-12.2.15. Allows a high-privileged attacker with local access to take over the component.
- CVE-2026-60154Medium
Vulnerability in Oracle Application Object Library (versions 12.2.3-12.2.15) in the Core component. A low-privileged attacker via HTTP can gain unauthorized read and modify access to data.
Original NVD description (English source)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).