This vulnerability affects Oracle Application Object Library versions 12.2.3 through 12.2.15 and involves the AOL Generic Loader component. It allows a high privileged attacker who already has logon access to the infrastructure where the Oracle Application Object Library executes to compromise the component. The vulnerability has a CVSS 3.1 score of 6.7 with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions many patches but does not explicitly state a patch or remediation for this vulnerability, leaving the patch status unconfirmed. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise and takeover of the Oracle Application Object Library component, impacting confidentiality, integrity, and availability of the affected system. The attacker must have high privileges and local access to the infrastructure where the component runs. This could enable unauthorized control over Oracle Application Object Library functions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches promptly when they become available. Until an official patch is released, organizations should ensure that only trusted, high privileged users have access to the infrastructure hosting Oracle Application Object Library and monitor for suspicious activity related to this component.