Oracle Public Sector Financials CVE-2026-60930

Exploitation requires a valid low-privileged Oracle EBS account with network HTTP access to the Oracle Public Sector Financials application; unauthenticated external attackers cannot exploit this vulnerability. The AC:H rating confirms that exploitation is not straightforward - specific and difficult-to-reproduce conditions must exist, such as a particular system state, timing window, or parameter configuration within the Internal Operations component. Only installations running versions 12.2.3 through 12.2.15 are affected. Deployments that have applied the July 2026 Oracle CPU are not affected. The scope is unchanged (S:U), meaning a successful attack cannot pivot to compromise other system components. Exploitation is further limited to read-only access of a partial data subset - no modification or service disruption is achievable through this vulnerability alone.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world risk profile. AV:N indicates the attack vector is network-accessible via HTTP, broadening the attack surface, but AC:H significantly reduces exploitability by requiring difficult, complex conditions to be met. PR:L means an attacker must first obtain valid low-privileged credentials before attempting exploitation, eliminating risk from fully external, unauthenticated actors. The impact ceiling is strictly confidentiality at a low level (C:L), with no integrity or availability impact confirmed. EPSS data was not provided in available intelligence sources. This vulnerability is absent from the CISA KEV catalog and no public proof-of-concept exploit has been identified, indicating no observed mass exploitation. The 'Authentication Bypass' tag in intelligence sources may overstate the exploitability - the actual CVSS data contradicts a full bypass scenario. Real-world priority for most organizations is LOW unless the deployment handles highly sensitive government financial data where even partial read exposure carries regulatory consequence.

An attacker who holds a valid low-privileged Oracle EBS account - for example, a data entry clerk or read-only departmental user - sends a specially crafted HTTP request to the Internal Operations component under a specific system state or configuration condition required to satisfy AC:H. If the precise triggering condition is met, the attacker receives a response containing a subset of financial records or internal configuration data beyond their authorized access level. No public exploit code currently exists, making opportunistic exploitation unlikely without dedicated research.