CVE-2026-60777 in Application Object Library
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability resides within Oracle Application Object Library, a critical component of the Oracle E-Business Suite that serves as the foundation for application development and object management across enterprise environments. The affected versions spanning 12.2.3 through 12.2.15 represent a substantial attack surface given their widespread deployment in corporate infrastructure. The vulnerability's classification as easily exploitable indicates that attackers with minimal technical expertise can leverage network-based HTTP access to compromise the system, making it particularly dangerous for organizations with exposed web applications.
The technical flaw manifests as a privilege escalation vulnerability that permits low-privileged attackers to gain unauthorized access to core application functionality. This weakness allows adversaries to execute unauthorized update, insert, or delete operations against specific data sets within the Application Object Library, while simultaneously enabling read access to sensitive information that should remain restricted. The partial denial of service component suggests that successful exploitation can disrupt system availability for certain functionalities, though not completely incapacitating the entire application suite. This vulnerability directly maps to CWE-284 (Improper Access Control) and aligns with ATT&CK techniques involving privilege escalation and data manipulation.
The operational impact extends beyond simple data compromise to include potential business disruption and regulatory compliance violations. Organizations utilizing affected versions face risks of unauthorized data modification that could corrupt financial records, customer information, or operational data critical to business processes. The confidentiality aspect creates exposure for sensitive business intelligence, while integrity concerns threaten data accuracy and system reliability. Availability impacts may manifest as partial service degradation affecting user productivity and system responsiveness. This vulnerability's CVSS 3.1 score of 6.3 indicates a moderate to high risk level that requires immediate attention from security teams.
Mitigation strategies should prioritize immediate patch deployment for all affected Oracle E-Business Suite versions, following Oracle's security bulletins and advisory releases. Network segmentation and access controls can provide temporary protection by limiting HTTP exposure and implementing additional authentication layers. Security monitoring should focus on detecting anomalous access patterns, unauthorized data modifications, and unusual network traffic originating from HTTP endpoints. Organizations should conduct comprehensive vulnerability assessments to identify all instances of affected software and implement continuous monitoring for similar privilege escalation vectors. The ATT&CK framework suggests implementing defensive measures against credential harvesting and privilege abuse techniques that attackers may employ when exploiting this vulnerability. Regular security updates and proper access control implementations remain essential defenses against this class of vulnerabilities in enterprise application environments.