CVE-2026-61111: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. While the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library
CVE-2026-61111 is a vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15 that allows a low privileged attacker with logon access to the infrastructure to compromise the Oracle Application Object Library. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the Oracle Application Object Library. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with significant confidentiality impact. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory in July 2026 addressing this and other vulnerabilities, recommending customers apply patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory, so users should consult the vendor advisory for current remediation guidance.
AI Analysis
Technical Summary
CVE-2026-61111 is a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker who has logon access to the infrastructure where the library executes to compromise the Oracle Application Object Library. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by the library. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches across multiple products, urging customers to apply patches promptly. However, the advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability, so users must verify patch status from the vendor advisory.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by the Oracle Application Object Library. The vulnerability affects confidentiality significantly but does not impact integrity or availability. Due to scope change, attacks may also impact additional Oracle products beyond the Oracle Application Object Library itself.
Mitigation Recommendations
Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Customers are strongly recommended to remain on actively supported versions and apply Oracle's security patches without delay. Patch status for this specific vulnerability is not explicitly stated; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated; thus, applying the relevant patches is the recommended mitigation.
CVE-2026-61111: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. While the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library
Description
CVE-2026-61111 is a vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15 that allows a low privileged attacker with logon access to the infrastructure to compromise the Oracle Application Object Library. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the Oracle Application Object Library. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with significant confidentiality impact. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory in July 2026 addressing this and other vulnerabilities, recommending customers apply patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory, so users should consult the vendor advisory for current remediation guidance.
CVSS v3.1
Score 6.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-61111 is a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker who has logon access to the infrastructure where the library executes to compromise the Oracle Application Object Library. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by the library. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches across multiple products, urging customers to apply patches promptly. However, the advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability, so users must verify patch status from the vendor advisory.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by the Oracle Application Object Library. The vulnerability affects confidentiality significantly but does not impact integrity or availability. Due to scope change, attacks may also impact additional Oracle products beyond the Oracle Application Object Library itself.
Mitigation Recommendations
Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Customers are strongly recommended to remain on actively supported versions and apply Oracle's security patches without delay. Patch status for this specific vulnerability is not explicitly stated; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated; thus, applying the relevant patches is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.614Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee2d9c2644c7f8d5d268
Added to database: 07/21/2026, 22:09:49 UTC
Last enriched: 07/22/2026, 01:38:15 UTC
Last updated: 07/22/2026, 01:38:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.