This vulnerability affects the Internal Operations component of Oracle Public Sector Financials within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the system, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation details for this vulnerability.

Successful exploitation can lead to complete compromise of Oracle Public Sector Financials, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected application, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for CVE-2026-60931. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should limit network exposure of Oracle Public Sector Financials and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.