CVE-2026-60985
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Project Portfolio Analysis component of the Oracle E-Business Suite, specifically within the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product's lifecycle. The vulnerability is classified as easily exploitable, meaning that an attacker with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP protocol, making it particularly dangerous as it can be executed from remote locations without requiring physical system access or specialized equipment.
The technical flaw manifests as a privilege escalation vulnerability that allows low-privileged attackers to gain unauthorized access to critical data within the Project Portfolio Analysis system. This weakness enables attackers to perform unauthorized operations including creation, deletion, and modification of sensitive project data, potentially compromising the integrity of the entire project portfolio management system. The vulnerability's impact extends beyond simple data manipulation as it also provides the capability for partial denial of service attacks that can disrupt normal business operations and reduce system availability.
From a security impact perspective, this vulnerability carries a CVSS 3.1 base score of 7.1, which represents a high severity threat level. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L indicates that the attack requires network access with low complexity but only low privilege levels, and no user interaction is needed for exploitation. The system scope is unchangeable, meaning the vulnerability affects the entire application rather than just specific components. The integrity impact is rated as high, reflecting the potential for data modification and corruption that could severely compromise project data accuracy and reliability.
The operational impact of this vulnerability extends across multiple business functions within organizations using Oracle E-Business Suite. Project managers and financial analysts who rely on accurate portfolio data may face significant disruptions when attackers modify or delete critical project information. The partial denial of service capability can disrupt project planning and resource allocation activities, potentially affecting business continuity and decision-making processes. Organizations may experience regulatory compliance challenges if sensitive project data is compromised, particularly in industries with strict data governance requirements such as financial services, healthcare, or government sectors.
Organizations should implement immediate mitigations including network segmentation to limit access to the affected system, enabling additional authentication controls, and applying Oracle's security patches as soon as they become available. The vulnerability aligns with CWE-284 (Improper Access Control) and may be related to ATT&CK techniques involving privilege escalation and data manipulation. Regular monitoring of system logs for unauthorized access attempts and implementing automated threat detection mechanisms can help identify exploitation attempts before they cause significant damage.
Security teams should conduct comprehensive risk assessments to determine the full scope of potential impacts within their organization's specific deployment environments. The vulnerability's characteristics suggest it may be exploited in targeted attacks against organizations with high-value project portfolios, making it particularly attractive to both cybercriminals and nation-state actors seeking to disrupt business operations or extract sensitive financial information. Continuous security monitoring, regular vulnerability assessments, and maintaining up-to-date security patches are essential defensive measures that should be implemented immediately to protect against exploitation of this vulnerability.