CVE-2026-60985
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Oracle Project Portfolio Analysis (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
Risk Assessment
Risk of unauthorized modification of critical data and partial denial of service.
Recommendation
Apply the patch from Oracle Critical Patch Update (CPU).
Other vulnerabilities in Oracle Project Portfolio Analysis
See all- CVE-2026-60988High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Despite high attack complexity, a low-privileged attacker with network access can take over the system, compromising confidentiality, integrity, and availability.
- CVE-2026-60987High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorizedly modify critical data and read a subset of data.
- CVE-2026-60986High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60984High
Vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized modification of critical data and read some data.
- CVE-2026-46962High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Affected versions are 12.2.3-12.2.15.
- CVE-2026-46961High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Supported versions affected are 12.2.3-12.2.15.
- CVE-2026-46960High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to take over Oracle Project Portfolio Analysis. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).