CVE-2026-60984 in Project Portfolio Analysis
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Portfolio Analysis, a component of the broader Oracle E-Business Suite ecosystem, specifically within the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple releases of this enterprise resource planning solution. The vulnerability represents a critical security weakness that can be exploited by attackers with minimal privileges and network access through standard HTTP protocols, making it particularly dangerous in enterprise environments where internal network boundaries may not be adequately segmented.
The technical flaw manifests as an insufficient authorization mechanism within the Project Portfolio Analysis module, allowing authenticated users with low privilege levels to perform unauthorized operations against sensitive data repositories. This weakness enables attackers to execute actions that should require higher administrative privileges, including creating, deleting, or modifying critical project data and financial information. The vulnerability's exploitability score of 7.1 on the CVSS 3.1 scale reflects the relatively straightforward nature of the attack vector combined with the significant impact on system integrity and confidentiality.
The operational impact of this vulnerability extends beyond simple data compromise, as it can lead to complete disruption of project portfolio management processes and financial reporting accuracy. Attackers could potentially manipulate project budgets, resource allocations, or timeline forecasts, causing cascading effects throughout organizational planning and decision-making processes. The unauthorized read access to subset data means that sensitive business intelligence and strategic information could be extracted without detection, potentially compromising competitive positioning and regulatory compliance efforts.
The vulnerability's CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network-based exploitation requiring only low privilege authentication, with no user interaction needed. This classification aligns with CWE-284, which addresses insufficient access control vulnerabilities, and maps to attack patterns in the MITRE ATT&CK framework under privilege escalation and credential access techniques. Organizations should implement immediate mitigations including patching to supported versions, network segmentation to limit access to the affected module, and enhanced monitoring of administrative activities within the Project Portfolio Analysis component.
Security teams must prioritize this vulnerability given its potential for data manipulation and exposure across critical business operations. The combination of low attack complexity and high integrity impact makes this an attractive target for both insider threats and external attackers seeking to compromise enterprise project management systems. Organizations should conduct comprehensive risk assessments to identify all instances of affected software and implement layered security controls including application firewalls, access logging, and regular security audits to prevent exploitation. The vulnerability underscores the importance of maintaining up-to-date security patches in enterprise ERP systems where multiple modules share common authentication and authorization mechanisms.