Oracle Public Sector Financials CVE-2026-60929

A valid low-privileged Oracle E-Business Suite account is required - unauthenticated exploitation is not possible per the CVSS PR:L metric. High Attack Complexity (AC:H) indicates that additional prerequisites beyond standard authenticated access must be met, such as specific application state, a particular sequence of operations, or timing conditions within the Internal Operations component; the vendor description does not enumerate these precisely. The vulnerability is scoped exclusively to Oracle Public Sector Financials versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, accessed via HTTP. Exploitation is further bounded by the S:U (Unchanged Scope) metric, meaning the attacker cannot pivot beyond the Oracle Public Sector Financials system boundary, and by I:L, limiting unauthorized data manipulation to a subset of accessible records rather than full data takeover. The 'Authentication Bypass' tag may suggest a post-authentication privilege escalation within the application rather than a bypass of the login mechanism itself.

The overall risk posture of this vulnerability is low in real-world terms, consistent with the CVSS 3.1 base score of 3.1. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects three meaningful constraints: an authenticated attacker is required (PR:L), exploitation is difficult (AC:H), and impact is limited solely to partial data integrity (C:N/I:L/A:N) with no scope change. No EPSS score was included in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified. The 'Authentication Bypass' tag introduces a mild inconsistency - it may overstate the nature of the flaw relative to the PR:L vector, and defenders should not treat this as unauthenticated. For public sector organizations subject to financial data integrity requirements (e.g., FISMA, FedRAMP), even limited unauthorized data modification may have compliance implications disproportionate to the raw CVSS score, warranting patching within normal maintenance cycles rather than emergency response.

An attacker with a low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the Internal Operations component under specific application conditions (reflecting the AC:H constraint) that trigger an authorization control bypass. With the bypass achieved, the attacker can insert, update, or delete a subset of Oracle Public Sector Financials data beyond their authorized scope - for example, modifying financial records or transactional entries. No publicly available exploit code exists at time of analysis, increasing the practical difficulty of exploitation.