What is the CVSS score of CVE-2026-60927?

CVE-2026-60927 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60927?

CVE-2026-60927 affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the Public Sector Financials module deployed, enabling authenticated low-privilege users to achieve complete system…

How to fix or mitigate CVE-2026-60927?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and verify which instances have the Public Sector Financials module enabled; prioritize systems with public network exposure or high-risk user populations. Within 7 days, apply the July 2026 Critical Patch Update from Oracle to all affected systems; coordinate with financial and operations teams to schedule patching during low-risk windows and verify module functionality post-patch. Within 30 days, complete patching across all affected EBS instances, conduct user access reviews to ensure low-privileged accounts have appropriate restrictions to financial transaction capabilities, and validate transaction logs for any suspicious activity during the exposure window.

Oracle E-Business Suite CVE-2026-60927

EUVD-2026-47193 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vvw9-ch49-r4p9

Privilege Escalation Oracle Public Sector Financials

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Authenticated low-priv user (PR:L) over HTTP (AV:N) with non-trivial preconditions (AC:H) achieving full module takeover justifies C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:30 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning (ERP) suite; Public Sector Financials is the government/public-sector financial management module, and the affected surface is the Internal Operations component reached over HTTP through the EBS web tier (typically Oracle Application Server / WebLogic fronting the E-Business Suite forms and OA Framework pages). Oracle does not publish a specific CWE for this issue (CWE: N/A) and the advisory withholds root-cause detail per Oracle's standard CPU disclosure practice, but the combination of network HTTP vector, low-privilege requirement, and full C/I/A takeover is consistent with an authenticated web-tier flaw (for example an injection or access-control weakness) in an authenticated application function. The Oracle-supplied tag 'Information Disclosure' hints at a confidentiality-relevant primitive, though the vector shows equal Integrity and Availability impact consistent with the described full takeover.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is Patch available per vendor advisory - Oracle CPUs ship as cumulative patch sets rather than a single tagged product version, so consult the CPU patch availability matrix for the exact EBS 12.2 patch corresponding to your release level. As compensating controls until patching, restrict network reach to the EBS web tier by placing it behind VPN/segmentation and limiting HTTP access to the Internal Operations/Public Sector Financials functions to trusted users, tighten and audit low-privileged application accounts (the attack requires valid credentials), and put a WAF or reverse proxy in front of the OA Framework endpoints to inspect and rate-limit requests; note the trade-off that aggressive filtering or URL restrictions on EBS can break legitimate application flows and should be validated in a test environment first. Because Oracle CPU patches are cumulative, applying the July 2026 CPU also remediates prior EBS issues.