CVE-2026-60986 in Project Portfolio Analysis
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Portfolio Analysis, a component of the Oracle E-Business Suite ecosystem that operates under the Internal Operations framework. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product lifecycle where security flaws have been identified. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to execute successful attacks, making it particularly dangerous in production environments where such systems handle sensitive business data.
The technical flaw manifests through insufficient access controls within the Oracle Project Portfolio Analysis module, allowing authenticated users with low privilege levels to perform unauthorized operations against the underlying database and application components. The vulnerability's attack vector utilizes HTTP network protocols, meaning that an attacker positioned outside the corporate firewall can potentially exploit this weakness without requiring physical access or specialized credentials beyond basic authentication. This characteristic places the system at risk from external threat actors who may have obtained legitimate user credentials through social engineering, phishing campaigns, or credential reuse attacks.
The operational impact of this vulnerability extends far beyond simple data theft, encompassing complete compromise of data integrity and confidentiality within the Project Portfolio Analysis environment. Attackers can create, delete, or modify critical business data including project timelines, resource allocations, budget forecasts, and financial analyses that directly affect organizational decision-making processes. The potential for unauthorized access to all accessible data within the Oracle Project Portfolio Analysis system represents a severe breach of information security principles, as it allows attackers to manipulate not just individual records but entire datasets that form the foundation of project management and portfolio analysis capabilities.
The CVSS 3.1 base score of 8.1 reflects the significant risk posed by this vulnerability, particularly given the high confidentiality and integrity impacts it creates. The vector assessment reveals that an attacker requires low privileges (PR:L) to exploit the weakness, indicating that even users with basic operational access can cause substantial damage. Network accessibility (AV:N) further amplifies the threat surface, while the absence of user interaction requirements (UI:N) means that automated exploitation tools could potentially compromise systems without human intervention. The unscoped impact (S:U) suggests that the vulnerability affects the entire system rather than being contained to specific modules or components.
Organizations should prioritize immediate patching of affected Oracle E-Business Suite installations, as this vulnerability represents a critical security risk that can enable comprehensive data manipulation and unauthorized access to business-critical information. The vulnerability aligns with CWE-284 (Improper Access Control) and may relate to ATT&CK techniques involving privilege escalation and data manipulation within enterprise applications. Security teams should implement network segmentation controls, monitor for suspicious HTTP traffic patterns, and establish robust user access management policies to limit the potential impact of such vulnerabilities in environments where privileged accounts might be compromised.
The exploitation of this vulnerability could lead to substantial financial losses through unauthorized project budget modifications, resource reallocation without proper authorization, or complete data destruction that would require extensive recovery procedures. Organizations should also consider implementing database activity monitoring solutions and regular security assessments to detect potential misuse of legitimate user credentials. Given the widespread adoption of Oracle E-Business Suite across enterprise environments, this vulnerability represents a significant risk to organizations that depend on accurate project portfolio data for strategic planning and resource allocation decisions.
Security administrators must conduct comprehensive risk assessments to identify all instances of affected Oracle E-Business Suite versions within their infrastructure and prioritize remediation efforts accordingly. The vulnerability's characteristics suggest that attackers could potentially use it as a foothold for broader attacks against connected systems, making immediate action essential to prevent lateral movement within network environments. Regular security updates and patch management procedures should be reinforced to ensure that such access control weaknesses are addressed promptly before they can be exploited by malicious actors in the current threat landscape.