Threat Intelligence Database

CVE-2026-61114 is a vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15 that allows a low privileged attacker with network access via HTTP to potentially take over the Oracle Application Object Library component. The vulnerability affects the DB Privileges component and has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Exploitation is considered difficult due to the required attack conditions. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, including this one, but no explicit patch or remediation level is stated for this specific vulnerability in the provided advisory content.

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-60154 is a vulnerability in Oracle Application Object Library versions 12.2.3 through 12.2.15 that allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability impacts confidentiality and integrity but does not affect availability. It has a CVSS 3.1 base score of 5.4, indicating medium severity. No explicit patch or remediation level is confirmed in the vendor advisory, but Oracle recommends applying Critical Patch Updates promptly. There are no known exploits in the wild at this time.