CVE-2026-61113: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. in Oracle Corporation Oracl
CVE-2026-61113 is a high-severity vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized creation, deletion, or modification access to critical data or all data accessible through the Oracle Application Object Library. The vulnerability is difficult to exploit but can lead to significant confidentiality and integrity impacts. The CVSS 3.1 base score is 7.4, indicating a high severity level. Oracle has published a Critical Patch Update advisory in July 2026 that addresses this and many other vulnerabilities, recommending prompt patching. No explicit patch version or remediation details for this specific vulnerability are provided in the advisory excerpt, so users should consult the official Oracle advisory for patch availability and installation instructions.
AI Analysis
Technical Summary
This vulnerability affects the Oracle Application Object Library component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the application, potentially resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Application Object Library. The vulnerability is rated with a CVSS 3.1 score of 7.4, reflecting high confidentiality and integrity impacts but no availability impact. The attack complexity is high, and no privileges or user interaction are required. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches across multiple products. However, the advisory does not explicitly state the patch version that fixes this vulnerability, so users must refer to the advisory and related patch documentation for remediation details.
Potential Impact
Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible via the Oracle Application Object Library. This compromises confidentiality and integrity of the affected system's data. The vulnerability does not impact availability. The attack requires network access via HTTP but no authentication, making it a significant risk if unpatched.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Users should promptly review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle Application Object Library versions. Since no specific patch version is stated in the advisory excerpt, checking the official patch availability document and installation instructions is essential. Until patched, limiting network access to the Oracle Application Object Library via HTTP may reduce exposure. No vendor advisory states that no action is required or that the vulnerability is already mitigated.
CVE-2026-61113: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. in Oracle Corporation Oracl
Description
CVE-2026-61113 is a high-severity vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized creation, deletion, or modification access to critical data or all data accessible through the Oracle Application Object Library. The vulnerability is difficult to exploit but can lead to significant confidentiality and integrity impacts. The CVSS 3.1 base score is 7.4, indicating a high severity level. Oracle has published a Critical Patch Update advisory in July 2026 that addresses this and many other vulnerabilities, recommending prompt patching. No explicit patch version or remediation details for this specific vulnerability are provided in the advisory excerpt, so users should consult the official Oracle advisory for patch availability and installation instructions.
CVSS v3.1
Score 7.4high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Oracle Application Object Library component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the application, potentially resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Application Object Library. The vulnerability is rated with a CVSS 3.1 score of 7.4, reflecting high confidentiality and integrity impacts but no availability impact. The attack complexity is high, and no privileges or user interaction are required. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches across multiple products. However, the advisory does not explicitly state the patch version that fixes this vulnerability, so users must refer to the advisory and related patch documentation for remediation details.
Potential Impact
Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible via the Oracle Application Object Library. This compromises confidentiality and integrity of the affected system's data. The vulnerability does not impact availability. The attack requires network access via HTTP but no authentication, making it a significant risk if unpatched.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Users should promptly review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle Application Object Library versions. Since no specific patch version is stated in the advisory excerpt, checking the official patch availability document and installation instructions is essential. Until patched, limiting network access to the Oracle Application Object Library via HTTP may reduce exposure. No vendor advisory states that no action is required or that the vulnerability is already mitigated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.614Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee2d9c2644c7f8d5d26e
Added to database: 07/21/2026, 22:09:49 UTC
Last enriched: 07/22/2026, 01:25:00 UTC
Last updated: 07/22/2026, 01:25:00 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.