Public Sector Financials
Monthly
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.
Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.
Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.
Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.
Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read a subset of financial data and perform unauthorized insert, update, or delete operations via HTTP. The 'Authentication Bypass' tag associated with this vulnerability suggests the flaw may permit a low-privilege user to exceed their intended authorization scope within the Internal Operations component, rather than bypassing authentication entirely. No public exploit code or confirmed active exploitation has been identified at time of analysis, though Oracle's July 2026 Critical Patch Update addresses this issue.
Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.
Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows an authenticated low-privileged network attacker to exploit an authorization control weakness via HTTP, requiring a victim user to interact with attacker-influenced content to trigger a scope change affecting additional Oracle EBS products. Successful exploitation yields unauthorized read access to a subset of data and unauthorized write/insert/delete capability against accessible data, with impact propagating beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle July 2026 CPU discloses this as part of a batch advisory.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.