Application Object Library

CVE-2026-61116 Jul 21, 22:18 HIGH This Week

Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

CVE-2026-61114 Jul 21, 22:18 HIGH This Week

Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.

CVE-2026-61113 Jul 21, 22:18 HIGH This Week

Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.

CVE-2026-61111 Jul 21, 22:18 MEDIUM This Month

Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

CVE-2026-60777 Jul 21, 22:18 MEDIUM This Month

Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.

CVE-2026-60776 Jul 21, 22:18 MEDIUM This Month

Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

CVE-2026-60773 Jul 21, 22:18 CRITICAL Act Now

Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2026-60770 Jul 21, 22:18 HIGH This Week

Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.

CVE-2025-30732 Apr 15, 21:16 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2025-30730 Apr 15, 21:16 HIGH This Week

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-30726 Apr 15, 21:16 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-21128 Jul 16, 23:15 MEDIUM This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: APIs). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-20929 Feb 17, 02:15 MEDIUM This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-20915 Feb 17, 02:15 MEDIUM This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-21978 Apr 18, 20:15 MEDIUM This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: GUI). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-2314 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Profiles). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-14840 Oct 21, 15:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Diagnostics). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-14635 Jul 15, 18:15 MEDIUM This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Logging). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14554 Jul 15, 18:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Diagnostics). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-3027 Oct 16, 18:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login Help). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2761 Jul 23, 23:15 LOW PATCH Monitor

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.

CVE-2019-2621 Apr 23, 19:32 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-3244 Oct 17, 01:31 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-3138 Oct 17, 01:31 HIGH PATCH This Week

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10331 Oct 19, 17:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2017-10328 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2017-10246 Aug 08, 15:29 HIGH POC PATCH THREAT Act Now

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 12.9%.

CVE-2017-10244 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10177 Aug 08, 15:29 HIGH PATCH This Week

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Flexfields). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-3556 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: File Management). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-3246 Jan 27, 22:59 MEDIUM PATCH This Month

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Patching). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity.

CVE-2016-3545 Jul 21, 10:13 MEDIUM PATCH This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality via. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-3434 Apr 21, 11:00 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2016-0697 Apr 21, 10:59 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows local users to affect confidentiality and integrity. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

CVE-2016-0589 Jan 21, 03:02 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2016-0586 Jan 21, 03:02 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to iHelp. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2016-0585 Jan 21, 03:02 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via vectors related to ICX Error. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2016-0576 Jan 21, 03:02 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2016-0520 Jan 21, 03:01 MEDIUM This Month

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to Java APIs. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.