CVE-2026-60776
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Vulnerability in Oracle Application Object Library (component: AOL Generic Loader) versions 12.2.3-12.2.15. Allows a high-privileged attacker with local access to take over the component.
Risk Assessment
Risk of complete takeover of Oracle Application Object Library by a privileged local attacker, potentially compromising confidentiality, integrity, and availability.
Recommendation
Apply the patch provided by Oracle for versions 12.2.3-12.2.15. Restrict local access to the system to trusted users only.
Other vulnerabilities in Oracle Application Object Library
See all- CVE-2017-10328High
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Affected versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
- CVE-2026-60773Critical
Vulnerability in Oracle Application Object Library (Core component) allows a low-privileged attacker via HTTPS to unauthorizedly create, delete, or modify critical data and gain full access to all data. Attacks may impact additional products (scope change).
- CVE-2026-61116High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Easily exploitable, allows an unauthenticated attacker via HTTP to gain unauthorized access to all library data.
- CVE-2026-61114High
Vulnerability in Oracle Application Object Library (component: DB Privileges) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to compromise the system.
- CVE-2026-61113High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modify critical data.
- CVE-2026-61111Medium
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. A low-privileged attacker with local access can easily exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all Oracle Application Object Library data. The attack may impact other products.
- CVE-2026-60770High
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker with network access via HTTP to take over the application object library.
- CVE-2026-60154Medium
Vulnerability in Oracle Application Object Library (versions 12.2.3-12.2.15) in the Core component. A low-privileged attacker via HTTP can gain unauthorized read and modify access to data.
Original NVD description (English source)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: AOL Generic Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).