CVE-2026-60930: Oracle Public Sector Financials Disclosure

CVE-2026-60930 Overview

CVE-2026-60930 affects the Oracle Public Sector Financials product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this weakness to gain unauthorized read access to a subset of Oracle Public Sector Financials data. The vulnerability is difficult to exploit and impacts confidentiality only. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows an authenticated remote attacker to read a limited subset of Oracle Public Sector Financials data over HTTP.

Affected Products

Oracle E-Business Suite - Oracle Public Sector Financials 12.2.3
Oracle E-Business Suite - Oracle Public Sector Financials versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Public Sector Financials 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60930 published to NVD as part of Oracle Critical Patch Update July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60930

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle Public Sector Financials, a module of Oracle E-Business Suite used by government and public sector organizations for financial management. An authenticated attacker holding low-level application privileges can send crafted HTTP requests to the affected component and retrieve information they are not authorized to view.

The issue is classified as information disclosure. Exploitation does not modify data or affect availability, and no user interaction is required. Oracle notes the attack is difficult to execute, meaning the attacker must satisfy conditions outside their direct control. The vulnerability is scoped to a subset of accessible data rather than the full application datastore.

EPSS data from 2026-07-23 reports an exploitation probability of approximately 0.23% with a percentile of 13.9, indicating limited near-term exploitation likelihood. No public proof-of-concept, exploit code, or evidence of exploitation in the wild is available at the time of publication.

Root Cause

Oracle has not published detailed root cause information. Based on the advisory, the defect involves improper access enforcement inside the Internal Operations component, permitting authenticated users to read records outside their authorization scope. Refer to the Oracle Critical Patch Update July 2026 for vendor-supplied technical details.

Attack Vector

The attack vector is network-based over HTTP. The attacker must already possess valid low-privileged credentials to the Oracle Public Sector Financials application. Once authenticated, the attacker issues HTTP requests to the vulnerable Internal Operations endpoint to retrieve data outside their authorization boundary. No user interaction is required, and the scope remains unchanged.

No verified exploit code is publicly available. See the Oracle Critical Patch Update July 2026 advisory for vendor guidance.

Detection Methods for CVE-2026-60930

Indicators of Compromise

Unusual HTTP request patterns from low-privileged Oracle E-Business Suite accounts targeting Internal Operations endpoints under Oracle Public Sector Financials.
Elevated read volumes or unexpected data export activity from standard user accounts that historically operate on narrow record sets.
Access log entries showing repeated requests to Financials URLs from accounts not associated with financial reporting roles.

Detection Strategies

Review Oracle E-Business Suite application access logs for authenticated sessions accessing Internal Operations resources outside the user's assigned responsibility.
Correlate database audit records against application-layer authorization to identify reads that bypass expected role scoping.
Baseline normal query and page-access patterns per user role, then alert on deviations affecting Public Sector Financials modules.

Monitoring Recommendations

Enable Oracle E-Business Suite sign-on audit and page access tracking for all Financials responsibilities.
Forward Oracle application, middleware, and database audit logs to a centralized SIEM for correlation and retention.
Monitor Oracle HTTP Server access logs for anomalous URI patterns targeting Internal Operations functions.

How to Mitigate CVE-2026-60930

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Oracle Public Sector Financials.
Inventory user accounts with access to the Internal Operations component and remove responsibilities that are not required for job function.
Rotate credentials for any low-privileged accounts that showed anomalous access to Public Sector Financials since the CVE publication date.

Patch Information

Oracle released fixes for CVE-2026-60930 in the Oracle Critical Patch Update issued July 2026. Administrators should follow the patch application instructions in the Oracle Critical Patch Update July 2026 advisory and validate patch application against Oracle-supplied readiness scripts before returning the system to production.

Workarounds

Restrict HTTP access to Oracle E-Business Suite Internal Operations URLs to trusted internal networks using Oracle HTTP Server URL firewall rules or an upstream reverse proxy.
Tighten Oracle E-Business Suite responsibility and menu assignments to enforce least privilege for the Public Sector Financials module until patching is complete.
Enable and review Oracle E-Business Suite auditing on sensitive Financials tables to detect unauthorized reads pending patch deployment.

bash

# Configuration example
# Refer to the Oracle Critical Patch Update July 2026 advisory for authoritative patch steps:
# https://www.oracle.com/security-alerts/cpujul2026.html