CVE-2026-61114
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in Oracle Application Object Library (component: DB Privileges) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to compromise the system.
Risk Assessment
Risk of full takeover of Oracle Application Object Library, potentially leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Install the Oracle update for your version in the 12.2.3-12.2.15 range. Monitor user privileges and access logs.
Other vulnerabilities in Oracle Application Object Library
See all- CVE-2017-10328High
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Affected versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7.
- CVE-2026-60773Critical
Vulnerability in Oracle Application Object Library (Core component) allows a low-privileged attacker via HTTPS to unauthorizedly create, delete, or modify critical data and gain full access to all data. Attacks may impact additional products (scope change).
- CVE-2026-61116High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Easily exploitable, allows an unauthenticated attacker via HTTP to gain unauthorized access to all library data.
- CVE-2026-61113High
Vulnerability in Oracle Application Object Library (component: Core) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modify critical data.
- CVE-2026-61111Medium
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. A low-privileged attacker with local access can easily exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all Oracle Application Object Library data. The attack may impact other products.
- CVE-2026-60776Medium
Vulnerability in Oracle Application Object Library (component: AOL Generic Loader) versions 12.2.3-12.2.15. Allows a high-privileged attacker with local access to take over the component.
- CVE-2026-60770High
Vulnerability in Oracle Application Object Library (Core component) versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker with network access via HTTP to take over the application object library.
- CVE-2026-60154Medium
Vulnerability in Oracle Application Object Library (versions 12.2.3-12.2.15) in the Core component. A low-privileged attacker via HTTP can gain unauthorized read and modify access to data.
Original NVD description (English source)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).