What is the CVSS score of CVE-2026-61114?

CVE-2026-61114 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61114?

Oracle Application Object Library in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to complete system compromise via authenticated low-privileged accounts.

How to fix or mitigate CVE-2026-61114?

Within 24 hours, inventory all systems running Oracle EBS versions 12.2.3 through 12.2.15 and audit active low-privileged user accounts with access to the Application Object Library. Within 7 days, restrict low-privileged account privileges to the Application Object Library, implement application firewall rules to block malformed HTTP requests to the module, and enable detailed logging for all HTTP traffic targeting the Application Object Library. Within 30 days, establish formal escalation with Oracle support regarding patch timeline, evaluate feasibility of upgrading to patched EBS versions 12.2.16 or later if available, and conduct compensating control effectiveness assessment.

Oracle E-Business Suite CVE-2026-61114

EUVD-2026-47325 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-7m96-4987-p8ch

Oracle Privilege Escalation Application Object Library

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reach (AV:N) but a valid low-privilege EBS account (PR:L) and vendor-stated difficulty (AC:H); full takeover justifies C:H/I:H/A:H, no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:45 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Application Object Library (FND/AOL) is the foundational technology stack of Oracle E-Business Suite, providing the security model, concurrent processing, user/responsibility management, and database privilege handling for the entire ERP suite; the affected component is explicitly 'DB Privileges', which governs how EBS maps application users to database-level grants and roles. A weakness in this privilege-handling layer would allow an already-authenticated low-privilege EBS user to escalate to full control of AOL, effectively subverting the trust boundary between application-level and database-level authorization. Oracle did not assign a CWE (CWE: N/A) and the advisory text is deliberately sparse per Oracle CPU convention, so the precise root-cause class (e.g., improper authorization, privilege escalation, or SQL/injection into privilege logic) cannot be confirmed from the available data. The 'Information Disclosure' tag combined with the DB Privileges component suggests the flaw at minimum exposes or manipulates privileged data, consistent with the C:H/I:H/A:H takeover impact.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html - this is the primary and vendor-recommended remediation; Oracle CPU advisories do not publish a standalone fixed AOL version number, so no independently confirmed exact patched version is available beyond 'apply the July 2026 CPU'. Patch available per vendor advisory. Until the CPU is applied, reduce exposure with compensating controls: restrict network access to the EBS HTTP tier so it is not directly reachable from untrusted networks (place it behind VPN or an allowlisted reverse proxy), which limits the AV:N reach but may inconvenience remote users; tighten provisioning of low-privilege EBS application accounts and audit responsibilities tied to DB Privileges since PR:L exploitation requires a valid account; and increase monitoring/auditing of AOL and database privilege changes to detect anomalous escalation, accepting the added log-review overhead. These controls mitigate but do not remove the underlying flaw, so patching remains mandatory.