Oracle Application Object Library CVE-2026-60776

Exploitation requires two concrete prerequisites: (1) local logon access to the infrastructure host where Oracle Application Object Library executes - remote network exploitation is not applicable per AV:L; (2) high privilege level on that host (PR:H), meaning the attacker must operate as a privileged OS or application user, not a standard low-privilege account. No specific non-default configuration or additional feature enablement is described as a prerequisite beyond these access requirements. Exploitation is limited to environments running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the AOL Generic Loader component active, which is standard in EBS deployments. The local attack vector and high privilege requirement are the primary factors limiting real-world exploitation surface.

The CVSS 6.7 score reflects the local attack vector and high privilege prerequisite, which meaningfully constrain exploitability - an attacker must already hold elevated infrastructure access, ruling out opportunistic remote attacks. EPSS data was not provided, but given the local/high-privilege prerequisites, real-world exploitation probability is likely low absent additional information. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Despite the tag 'Information Disclosure,' the CVSS C:H/I:H/A:H vector indicates full application takeover - the tag may be incomplete or reflect one facet of the impact. The practical risk is highest in shared Oracle EBS hosting environments, managed service providers, or cloud lift-and-shift deployments where multiple tenants or service accounts have elevated access to the same infrastructure. The absence of a CWE and limited public detail reduce confidence in independent risk assessment.

An attacker who has already obtained high-privileged access to the Oracle EBS application server host - for example, through a compromised OS service account or a lateral movement from another internal system - interacts with the AOL Generic Loader component to exploit the flaw. Exploitation is straightforward once the required access is in hand (AC:L), requiring no user interaction, and results in full compromise of the Oracle Application Object Library instance. No public exploit code has been identified at time of analysis.