What is the CVSS score of CVE-2026-60773?

CVE-2026-60773 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60773?

A critical privilege escalation in Oracle Application Object Library (AOL/FND) affecting Oracle E-Business Suite versions 12.2.3-12.2.15 allows low-privileged authenticated users to read, modify, and…

How to fix or mitigate CVE-2026-60773?

Within 24 hours: isolate Oracle EBS instances running versions 12.2.3-12.2.15 from untrusted networks and implement restrictive access controls on all AOL/FND functions; escalate to Oracle Support (Critical SAR) requesting patch timeline and interim fixes, and notify business process owners of the high-risk exposure window. Within 7 days: deploy enhanced logging and alerting on all AOL data modifications and cross-product access; implement multi-factor authentication for all accounts accessing AOL; restrict network-level access to AOL/FND services to administrative networks only. Within 30 days: follow Oracle's patch release and deploy to all affected instances, or execute a coordinated upgrade to unaffected EBS versions if patches are not forthcoming; conduct a complete forensic review of access logs and data modification history for the entire exposure period to identify unauthorized access.

Oracle E-Business Suite CVE-2026-60773

EUVD-2026-47093 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c852-j46p-37gp

Authentication Bypass Oracle Application Object Library

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network-reachable over HTTPS with a low-privileged account and no interaction; scope change to other EBS products; high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:36 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.6

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Application Object Library. While the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Application Object Library (AOL, also known as FND) is the foundational application framework of Oracle E-Business Suite - it provides shared services such as user/session management, security and function/menu authorization, concurrent processing, flexfields, and profile options that virtually every other EBS module (Financials, HR, Procurement, etc.) is built on top of. Because AOL sits at the security core, a flaw here has outsized reach, which the CVSS scope-change flag (S:C) reflects: the vulnerable AOL component can be leveraged to affect resources managed by other EBS products in a different security authority. The vendor tag characterizes the issue as an Authentication Bypass; no CWE was assigned in the input, but the pattern is consistent with a broken-access-control / authorization weakness in the Core component that permits a low-privileged account to exceed its intended data and function boundaries.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) for your Oracle E-Business Suite 12.2.x release; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers mapped to your version, as the input does not specify an individual fix build. Oracle strongly advises applying CPU patches without delay because remaining on an unpatched supported release leaves the flaw exploitable. Until the CPU can be applied, reduce exposure by restricting network reachability of the EBS application tier to trusted segments and VPN users only, placing it behind a WAF/reverse proxy that limits access to authenticated internal users, tightening AOL responsibilities and function/menu grants so low-privileged accounts hold the minimum required access, and auditing FND user accounts to disable stale or shared logins - recognizing these are compensating controls that lower the attacker population but do not close the underlying authorization weakness, and overly aggressive network restrictions may disrupt legitimate integrations or self-service users.