What is the CVSS score of CVE-2026-60776?

CVE-2026-60776 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Oracle Application Object Library CVE-2026-60776

EUVD-2026-47096 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p5w8-2xj9-8942

Oracle Authentication Bypass Application Object Library

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local attack vector and high privilege prerequisite align with infrastructure-logon requirement; full CIA impact consistent with described application takeover.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:50 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: AOL Generic Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Oracle Application Object Library (AOL) is a foundational middleware layer within Oracle E-Business Suite (EBS), providing shared services such as session management, concurrent processing, and - relevant here - the Generic Loader utility used for seeding and importing application data. The affected version range, 12.2.3 through 12.2.15, covers the vast majority of actively maintained EBS 12.2 deployments. No CWE classification was assigned in NVD or by Oracle, so the root cause class is unconfirmed from available data; however, the 'takeover' language combined with the local execution context suggests a privilege escalation or insecure file/process handling flaw within the loader. The AV:L vector confirms exploitation must occur on the host where the AOL process runs, consistent with Oracle's phrasing 'logon to the infrastructure where Oracle Application Object Library executes.'

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update (CPU) for July 2026, available through Oracle's patch delivery channels (My Oracle Support). The advisory is located at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 'CPU July 2026' was not independently confirmed from the available reference data. As a compensating control where patching is not immediately feasible, restrict OS-level and database-level access to the AOL Generic Loader component to only explicitly authorized service accounts, reducing the pool of principals who can reach the vulnerable code path. Auditing and alerting on privilege escalation events on EBS application tier hosts provides detection coverage. Note that compensating controls do not eliminate the vulnerability and carry administrative overhead; patching remains the definitive fix.