This vulnerability affects Oracle Public Sector Financials, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to read unauthorized data subsets within the application. The vulnerability has a CVSS 3.1 score of 3.1, reflecting a low severity primarily due to confidentiality impact only. The attack complexity is high, requiring specific conditions to exploit, and no user interaction is needed. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this CVE. Oracle strongly encourages customers to remain on supported versions and apply patches without delay.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Public Sector Financials. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the potential impact. The confidentiality impact is limited, and the overall severity is low.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. Although no explicit patch or remediation level for CVE-2026-60930 is stated, customers should ensure they apply the latest Critical Patch Updates from Oracle for Oracle Public Sector Financials. Staying on actively supported versions and timely patching is the primary mitigation. Patch status is not yet confirmed specifically for this CVE—check the vendor advisory for current remediation guidance.