What is the CVSS score of CVE-2026-60931?

CVE-2026-60931 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Public Sector Financials are affected by CVE-2026-60931?

Oracle Public Sector Financials module (Oracle E-Business Suite versions 12.2.3-12.2.15) can be fully compromised by low-privileged users, exposing all financial data and risking operational…

How to fix or mitigate CVE-2026-60931?

Start immediately by inventorying all Oracle E-Business Suite systems running Public Sector Financials (versions 12.2.3-12.2.15) and identifying business-critical instances; within 24 hours, implement network-level access controls restricting HTTP connectivity to approved networks or requiring VPN authentication. Within 7 days, revoke unnecessary low-privileged user accounts, enforce multi-factor authentication for administrative access, and evaluate whether the Public Sector Financials module can be disabled operationally. Monitor Oracle's Critical Patch Update advisories continuously over the next 30 days; when version 12.2.16 or later is released, prioritize testing in non-production environments and schedule deployment during a controlled maintenance window.

Oracle Public Sector Financials CVE-2026-60931

EUVD-2026-47196 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-98w6-w5q3-h3v3

Privilege Escalation Oracle Public Sector Financials

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

HTTP-reachable so AV:N; Oracle states difficult to exploit hence AC:H; a valid low-privileged EBS account is required so PR:L; full takeover gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Public Sector Financials is a government/public-sector financial management suite delivered as part of the Oracle E-Business Suite 12.2 application platform, accessed through the EBS web tier (Oracle HTTP Server / WebLogic / OA Framework). The affected 'Internal Operations' component is reachable over HTTP, indicating the weakness lives in a web-facing application function rather than in the database core. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., injection, authorization bypass, or deserialization) cannot be confirmed from the available data; the tag 'Information Disclosure' hints at a data-exposure element, but the CVSS impact set (C:H/I:H/A:H, described as 'takeover') is far broader than pure disclosure and should take precedence. The affected code runs within the multi-tier EBS 12.2 architecture, so exploitation targets the application logic exposed to authenticated portal users.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; treat this as 'Patch available per vendor advisory' since Oracle ships remediation through the CPU rather than a single named point release - consult https://www.oracle.com/security-alerts/cpujul2026.html and apply the specific EBS 12.2 patch that Oracle maps to CVE-2026-60931 for your installed release. Because exploitation requires a low-privileged authenticated account over HTTP, effective compensating controls until patching completes include restricting network reachability of the EBS web tier to trusted users via VPN or IP allowlisting, tightening EBS responsibility/role assignments so untrusted accounts cannot reach the affected Internal Operations functions, and increasing web-tier and application audit logging to detect anomalous access (trade-off: access restrictions may disrupt legitimate remote or partner users, and Oracle does not typically support disabling individual EBS modules as a workaround). Do not rely on WAF rules alone given the flaw's application-logic nature.