CVE-2026-60154 in Application Object Library
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Application Object Library component of Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a security weakness that can be exploited by attackers with minimal privileges and network access through HTTP protocols. The vulnerability's low exploitability factor means that even relatively unsophisticated attackers can potentially compromise the affected system. The attack vector is particularly concerning as it leverages standard web protocols, making it accessible to threat actors who may not possess advanced technical capabilities.
The technical nature of this vulnerability allows for unauthorized data manipulation and access within the Oracle Application Object Library framework. Attackers with low privilege levels can potentially perform unauthorized update, insert, or delete operations on specific data sets within the library. Additionally, the flaw enables unauthorized read access to a subset of accessible data, creating potential exposure of sensitive information. The Common Weakness Enumeration categorizes this type of vulnerability under improper access control mechanisms, which aligns with the observed behavior of privilege escalation and unauthorized data handling.
The operational impact of this vulnerability extends beyond simple data compromise, as it creates opportunities for both confidentiality and integrity breaches within the Oracle E-Business Suite environment. The CVSS 3.1 base score of 5.4 indicates a medium severity level, but the implications are significant given that attackers can manipulate core application data without requiring elevated privileges. This vulnerability directly impacts the security posture of organizations relying on Oracle E-Business Suite, as it allows for potential data corruption through unauthorized modifications and information disclosure through unauthorized reading of sensitive data elements.
Organizations should implement immediate mitigation strategies including applying the relevant Oracle security patches and updates to address this vulnerability. Network segmentation and access controls should be strengthened to limit exposure of the affected components to untrusted networks. The ATT&CK framework categorizes this type of vulnerability under privilege escalation techniques, specifically focusing on unauthorized access to application data and database resources. Additional defensive measures include implementing web application firewalls, monitoring network traffic for suspicious HTTP requests, and conducting regular security assessments to identify potential exploitation attempts. System administrators should also review and tighten authentication mechanisms within the Oracle E-Business Suite to prevent unauthorized access through this specific vulnerability vector.