CVE-2026-61113
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modify critical data.
Risk Assessment
Risk of unauthorized access to all library data and its modification, potentially compromising confidentiality and integrity.
Recommendation
Apply the Oracle patch for your version in the 12.2.3-12.2.15 range. Implement multi-factor authentication and restrict network access.
Other vulnerabilities in Oracle Application Object Library
See all- CVE-2017-10328High
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Affected versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
- CVE-2026-60773Critical
Vulnerability in Oracle Application Object Library (Core component) allows a low-privileged attacker via HTTPS to unauthorizedly create, delete, or modify critical data and gain full access to all data. Attacks may impact additional products (scope change).
- CVE-2026-61116High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Easily exploitable, allows an unauthenticated attacker via HTTP to gain unauthorized access to all library data.
- CVE-2026-61114High
Vulnerability in Oracle Application Object Library (component: DB Privileges) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to compromise the system.
- CVE-2026-61111Medium
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. A low-privileged attacker with local access can easily exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all Oracle Application Object Library data. The attack may impact other products.
- CVE-2026-60776Medium
Vulnerability in Oracle Application Object Library (component: AOL Generic Loader) versions 12.2.3-12.2.15. Allows a high-privileged attacker with local access to take over the component.
- CVE-2026-60770High
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker with network access via HTTP to take over the application object library.
- CVE-2026-60154Medium
Vulnerability in Oracle Application Object Library (versions 12.2.3-12.2.15) in the Core component. A low-privileged attacker via HTTP can gain unauthorized read and modify access to data.
Original NVD description (English source)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).