This vulnerability affects Oracle Public Sector Financials component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product by unauthorized modification (update, insert, or delete) of some accessible data. The vulnerability is rated with a CVSS 3.1 score of 3.1, indicating low severity with integrity impact only. The vulnerability is difficult to exploit and does not affect confidentiality or availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific CVE but strongly recommends applying available patches promptly to mitigate vulnerabilities. There are no reports of known exploits in the wild.

Successful exploitation can lead to unauthorized modification (update, insert, or delete) of data accessible through Oracle Public Sector Financials, impacting data integrity. There is no impact on confidentiality or availability. The vulnerability requires network access via HTTP and low privileges, but is difficult to exploit.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60929. Customers are strongly advised to remain on actively supported versions and apply Oracle's security patches without delay as part of routine Critical Patch Updates. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.