What is the CVSS score of CVE-2026-60777?

CVE-2026-60777 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

E-Business Suite CVE-2026-60777

EUVD-2026-47097 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3x7v-3hr7-xj6p

Oracle Denial Of Service Authentication Bypass Application Object Library

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network HTTP attack, low complexity, low privilege (authenticated EBS user required), no interaction; partial CIA impact scoped to AOL data consistent with Oracle's advisory.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:50 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.3

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.

Technical ContextAI

Oracle Application Object Library (AOL) is the foundational services framework embedded in Oracle E-Business Suite, providing authentication infrastructure, user session management, profile options, concurrent processing, and menu/function security. Exploitation occurs via the HTTP protocol against the Core component of this library, meaning the attack surface is the standard EBS web interface rather than a database or OS-layer channel. The affected version range (12.2.3 through 12.2.15) spans the entirety of the EBS 12.2 release line, which is the actively supported and widely deployed generation. No CWE identifier has been assigned, so the precise code-level root cause class (e.g., missing authorization check, improper input validation, IDOR) cannot be confirmed from available data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) is consistent with a server-side access control or business logic flaw reachable through authenticated HTTP requests with no requirement for elevated privileges or user interaction.

RemediationAI

Apply the patches released in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish granular patch version identifiers within CVE descriptions; administrators should consult the CPU documentation directly to identify the applicable patch for their specific EBS version within the 12.2.3-12.2.15 range. As a compensating control prior to patching, restrict HTTP access to Oracle EBS endpoints - particularly the AOL Core component - to trusted internal network segments or enforce VPN-only access, eliminating the network attack vector for external threat actors. Note that this control does not mitigate insider threats from low-privileged internal users and may disrupt legitimate remote access workflows. Enforcing strong authentication controls and auditing low-privileged account activity within EBS can help detect exploitation attempts while patches are staged.