EUVD-2026-79530
GHSA-7c6j-mcjh-c9f6
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP reachable but vendor states difficult exploitation (AC:H) and high application privileges (PR:H); full triad takeover with scope change into other EBS products (S:C, C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Object Library. While the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker who already holds HIGH application privileges (PR:H) within Oracle E-Business Suite and network HTTP access to the Application Object Library Core component; affected builds are EBS 12.2.3 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-severity but hard-to-reach flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update published in the vendor advisory for Oracle E-Business Suite at https://www.oracle.com/security-alerts/cspusep2026.html, which is the authoritative source for the exact patched AOL/EBS bundle version - the input data does not specify a fix version, so confirm the applicable release update there before scheduling downtime, and prioritize environments where large numbers of users legitimately hold high-privilege responsibilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle E-Business Suite deployments and confirm which instances run 12.2.3 through 12.2.15, then review and tightly restrict the population of accounts holding elevated AOL or system-administrator responsibilities, suspending or time-boxing any that are not strictly required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today