CVE-2026-60930 in Public Sector Financials
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Public Sector Financials component, specifically in the Internal Operations module, affecting versions 12.2.3 through 12.2.15. The flaw represents a security weakness that can be exploited by adversaries with minimal privileges and network connectivity through HTTP protocols. The vulnerability's classification as difficult to exploit indicates that while it requires some level of technical skill and access, the attack surface remains accessible to determined threat actors. This particular weakness falls under the purview of CWE-284, which addresses improper access control mechanisms within software applications.
The technical nature of this vulnerability allows for unauthorized read access to a subset of data within the Oracle Public Sector Financials system, though it does not permit modification or deletion operations. The CVSS 3.1 scoring system rates this vulnerability at 3.1 out of 10, with the confidentiality impact being the primary concern. The vector analysis reveals an attack complexity of high, requiring significant technical knowledge to execute successfully, while the privilege requirements are low, suggesting that even users with minimal access rights could potentially exploit this weakness. The absence of user interaction requirements and the lack of environmental scope modifications indicate a straightforward attack pattern that does not require additional system compromise.
The operational impact of this vulnerability extends beyond simple data exposure, as it creates potential risks for financial data integrity within public sector organizations. Given that these systems typically handle sensitive fiscal information, unauthorized access to even subset data could provide attackers with valuable insights for further exploitation attempts. The low privilege requirement means that this vulnerability could be leveraged by insiders or external actors who have gained minimal access to the network infrastructure. Organizations utilizing affected versions should consider the potential for cascading attacks where initial data reconnaissance leads to more severe compromises.
Mitigation strategies should focus on implementing robust network segmentation to limit access points to these critical applications, ensuring proper authentication controls are in place, and maintaining current patch levels for Oracle E-Business Suite components. The ATT&CK framework would classify this vulnerability under techniques related to credential access and initial access through web application exploitation. Organizations should also consider implementing comprehensive monitoring solutions that can detect unusual data access patterns and establish clear incident response procedures for potential exploitation attempts. Regular security assessments of Oracle applications, particularly those handling sensitive financial data, remain critical for identifying similar vulnerabilities before they can be exploited by malicious actors.