CVE-2026-60931
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Public Sector Financials (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, but exploitation is difficult.
Risk Assessment
Risk of full takeover of Oracle Public Sector Financials, potentially leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for E-Business Suite.
Other vulnerabilities in Oracle Public Sector Financials
See all- CVE-2026-62478High
Vulnerability in Oracle Public Sector Financials (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system.
- CVE-2026-60927High
Vulnerability in Oracle Public Sector Financials (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, but exploitation is difficult.
Original NVD description (English source)
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).