This vulnerability affects Oracle Public Sector Payroll component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable network vulnerability that requires low privileges and no user interaction. Successful exploitation can lead to complete compromise of the Oracle Public Sector Payroll system, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm patch availability or remediation level for this specific vulnerability. Customers are urged to remain on supported versions and apply patches without delay.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle Public Sector Payroll. This includes unauthorized access to sensitive data (confidentiality impact), unauthorized modification of data or system state (integrity impact), and disruption of service (availability impact). The high CVSS score of 8.8 reflects the critical nature of this vulnerability.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio, including Oracle Public Sector Payroll. While the advisory does not explicitly confirm patch availability for CVE-2026-60924, customers should promptly apply the July 2026 Critical Patch Update and any subsequent patches to mitigate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is not yet explicitly confirmed for this vulnerability; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.