This vulnerability affects Oracle Public Sector Financials versions 12.2.3 to 12.2.15 and involves the Internal Operations component. It permits a low privileged attacker with network access via HTTP to compromise the product by unauthorized modification of data (update, insert, delete). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. The vulnerability is considered difficult to exploit. Oracle's July 2026 Critical Patch Update advisory references this product but does not explicitly confirm patch availability or remediation level for this specific issue.

Successful exploitation allows unauthorized modification (update, insert, delete) of some data accessible through Oracle Public Sector Financials, impacting data integrity. There is no impact on confidentiality or availability. The vulnerability requires network access via HTTP and low privileges, with high attack complexity, making exploitation difficult.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches for Oracle products, including Oracle Public Sector Financials. However, the specific patch status for CVE-2026-60929 is not explicitly confirmed in the advisory content provided. Customers are strongly recommended to remain on actively supported versions and apply Oracle Critical Patch Updates promptly. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.