CVE-2026-60927 is a vulnerability in the Internal Operations component of Oracle Public Sector Financials within Oracle E-Business Suite. It affects supported versions 12.2.3 through 12.2.15. The vulnerability allows a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly list a patch for this vulnerability but recommends applying available patches promptly and remaining on supported versions. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Public Sector Financials, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially leading to unauthorized access to sensitive financial data and disruption of financial operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle recommends applying security patches without delay and remaining on actively supported versions. Monitor Oracle's Critical Patch Update advisories, including the July 2026 update, for any released patches addressing this vulnerability. Until a patch is available, consider restricting network access to the affected service to trusted sources only to reduce exposure.