What is the CVSS score of CVE-2026-60770?

CVE-2026-60770 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60770?

Oracle Application Object Library (the core framework of E-Business Suite) in versions 12.2.3 through 12.2.15 contains a critical privilege escalation vulnerability allowing authenticated…

How to fix or mitigate CVE-2026-60770?

Within 24 hours: conduct a complete inventory of Oracle E-Business Suite deployments and identify all instances running versions 12.2.3 through 12.2.15, document which are internet-accessible, and assess the number of low-privileged accounts with HTTP access to the Application Object Library. Within 7 days: restrict HTTP network access to AOL components to only authorized administrative systems via firewall rules, enable comprehensive logging and real-time alerting on HTTP requests to AOL with focus on privilege escalation indicators, and deploy a Web Application Firewall with signatures targeting AOL escalation attack patterns. Within 30 days: establish continuous monitoring of Oracle security bulletins and CISA advisories for patch release, contact Oracle to understand patch timeline and beta testing availability, and prepare an expedited patching and change control plan for deployment within 48 hours of vendor patch release.

Oracle E-Business Suite CVE-2026-60770

EUVD-2026-47090 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4fj7-8fj6-qqvx

Oracle Authentication Bypass Application Object Library

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP vector (AV:N) with no UI, but vendor-rated difficult exploitation (AC:H) and a required low-privileged account (PR:L); full takeover justifies C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.

Technical ContextAI

Oracle Application Object Library (AOL/FND) is the foundational middleware layer of Oracle E-Business Suite, providing authentication, session management, concurrent processing, forms/framework services, and shared metadata used by nearly every other EBS module (Financials, HR, Supply Chain, etc.). Because AOL sits under the entire EBS application stack, a compromise of this 'Core' component is effectively a compromise of the application platform itself rather than a single business module. Oracle did not assign a CWE (listed N/A), and the advisory only categorizes the issue with tags of Information Disclosure and Oracle; the CVSS vector with C:H/I:H/A:H and 'takeover' language indicates the flaw permits reading, modifying, and denying access to AOL data and functions rather than a pure disclosure bug alone.

RemediationAI

Apply the July 2026 Oracle Critical Patch Update, which contains the fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set and prerequisites for your 12.2.x release (Patch available per vendor advisory - Oracle did not publish a discrete fixed sub-version, as EBS 12.2 is remediated via the cumulative CPU/AD-TXK patch bundles). Because exploitation requires network HTTP access plus a low-privileged account, effective compensating controls until patching include restricting external exposure of the EBS web tier behind a VPN or the Oracle EBS DMZ URL-firewall configuration (limiting which servlets/pages are reachable externally), enforcing strong authentication and pruning unnecessary application user accounts to shrink the pool of low-privileged attackers, and increasing monitoring of AOL/FND servlet and concurrent-manager activity; note that tightening the DMZ URL allowlist can break self-service functionality for external users, so validate against your published-page requirements before enforcing.