CVE-2026-60587 in Project Foundation
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Project Definition). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Project Foundation accessible data as well as unauthorized read access to a subset of Oracle Project Foundation accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Foundation. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Foundation, a critical component of the Oracle E-Business Suite ecosystem that manages project-related data and processes. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure where organizations utilizing these suite versions remained susceptible to exploitation. The vulnerability manifests as a security flaw in the Project Definition component, which serves as the foundational structure for project management within the Oracle E-Business Suite environment.
The technical nature of this weakness allows for remote exploitation through HTTP network access, making it particularly dangerous as attackers do not require physical presence or direct system access. This characteristic aligns with CWE-20, representing a common input validation vulnerability where insufficient restrictions are placed on user-supplied data that can be manipulated to alter system behavior. The low privilege requirement for exploitation means that even users with minimal access rights can potentially compromise the system, making this vulnerability particularly concerning from a security posture perspective.
The operational impact of successful exploitation encompasses multiple critical areas of data integrity and availability. Attackers can achieve unauthorized update, insert, or delete operations against specific Project Foundation data elements, representing a direct violation of data integrity principles as defined by the CIA triad. Additionally, the vulnerability enables unauthorized read access to a subset of accessible project data, creating confidentiality breaches that could expose sensitive business information including project costs, timelines, resource allocations, and other proprietary project details. The partial denial of service capability further compounds the impact by potentially disrupting project management workflows and system availability for legitimate users.
From an attack framework perspective, this vulnerability maps to multiple ATT&CK techniques including T1213 (Data from Information Repositories) for the data access capabilities and T1499 (Endpoint Denial of Service) for the partial DOS effects. The CVSS 3.1 score of 6.3 reflects a medium severity classification, with base metrics indicating low attack complexity, low privilege requirements, and no user interaction needed. The vector assessment shows AV:N (network) AC:L (low), PR:L (low), UI:N (no user interaction), S:U (unspecified scope), C:L (low confidentiality impact), I:L (low integrity impact), and A:L (low availability impact). Organizations should prioritize patching efforts to address this vulnerability, implementing network segmentation controls, monitoring for anomalous access patterns, and establishing robust access controls to limit the potential impact of exploitation. The vulnerability represents a significant risk to project management data integrity and business continuity operations within affected Oracle E-Business Suite deployments.