Oracle Public Sector Financials CVE-2026-60931

Exploitation requires (1) network access to the Oracle E-Business Suite web tier over HTTP and (2) a valid low-privileged EBS user account (CVSS PR:L - this is authenticated, not anonymous). Additionally, Oracle rates the vulnerability 'difficult to exploit' (AC:H), meaning the attacker must satisfy a non-default condition beyond their control - such as winning a race or meeting a specific environmental/state precondition - which materially limits reliable exploitation. No user interaction is required (UI:N) and scope is unchanged (S:U). The affected function is the Internal Operations component of Oracle Public Sector Financials on EBS 12.2.3-12.2.15; environments that do not deploy the Public Sector Financials module are not exposed.

The signals are mixed and point to a genuine-but-not-emergency priority. The CVSS 3.1 base score is 7.5 (High) driven by full C/I/A 'takeover' impact, but two metrics materially reduce real-world urgency: AC:H (Oracle explicitly calls it 'difficult to exploit,' implying a non-trivial condition or race the attacker must win) and PR:L (a valid low-privileged EBS account is required, so this is not anonymous internet exploitation). There is no EPSS score in the provided data, the flaw is not in CISA KEV (so no confirmed active exploitation), and no public exploit identified at time of analysis. The combination - high impact but high complexity and required authentication - describes a vulnerability that is dangerous once an attacker already has a foothold or valid credentials, rather than a wormable internet-facing threat. Note one caveat: the 'Information Disclosure' tag conflicts with the 'takeover' / full-integrity-and-availability impact in the CVSS vector - treat the CVSS vector as authoritative and verify scope with Oracle's advisory.

An attacker who holds or phishes a low-privileged Oracle E-Business Suite account submits crafted HTTP requests to the Public Sector Financials Internal Operations functionality and, after satisfying the difficult-to-exploit precondition (AC:H), escalates to full control of the module. Because impact is rated as takeover, the attacker can then read and alter financial records and disrupt the service. No public exploit identified at time of analysis, so this would require the attacker to independently develop the exploit.