What is the CVSS score of CVE-2026-60930?

CVE-2026-60930 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Public Sector Financials CVE-2026-60930

EUVD-2026-47195 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-fv2q-w93g-47v8

Information Disclosure Oracle Public Sector Financials

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network HTTP attack vector confirmed; AC:H reflects difficult exploitation conditions; PR:L required per description; only limited confidentiality impact with no integrity or availability effects observed.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:37 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Oracle Public Sector Financials is a specialized module within Oracle E-Business Suite (EBS) designed for government and public sector accounting and financial management. The affected component is 'Internal Operations,' a server-side business logic layer accessible via HTTP. The 'Authentication Bypass' tag in conjunction with PR:L in the CVSS vector most likely indicates an intra-application authorization bypass: an authenticated low-privileged user can access data belonging to a higher-privileged role or a separate access domain within the Internal Operations component. No CWE is assigned, but the pattern is consistent with CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization). The AV:N/AC:H combination means the attack is network-reachable but requires specific, difficult-to-reproduce conditions - possibly a race condition, specific parameter manipulation, or a particular system state.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative within a release train, so organizations running any affected version between 12.2.3 and 12.2.15 should apply the July 2026 CPU to bring the installation to a patched state. No exact fixed version number was specified in available advisory data beyond the CPU reference. If immediate patching is not feasible, restrict network access to the Oracle EBS Internal Operations component to the minimum required user population, enforce strong credential policies to limit the pool of low-privileged accounts that could be leveraged, and audit access logs for anomalous read activity within the Internal Operations module. Note that restricting HTTP access broadly may impact legitimate EBS workflows and should be tested in a non-production environment first.