CVE-2026-46962
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Affected versions are 12.2.3-12.2.15.
Risk Assessment
An attacker can gain full control over Oracle Project Portfolio Analysis, potentially leading to serious breaches of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to update to the latest version of Oracle E-Business Suite to mitigate this vulnerability and to monitor system access for potential attack attempts.
Other vulnerabilities in Oracle Project Portfolio Analysis
See all- CVE-2026-60988High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Despite high attack complexity, a low-privileged attacker with network access can take over the system, compromising confidentiality, integrity, and availability.
- CVE-2026-60987High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorizedly modify critical data and read a subset of data.
- CVE-2026-60986High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60985High
Vulnerability in Oracle Project Portfolio Analysis (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
- CVE-2026-60984High
Vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized modification of critical data and read some data.
- CVE-2026-46961High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Supported versions affected are 12.2.3-12.2.15.
- CVE-2026-46960High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to take over Oracle Project Portfolio Analysis. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).