CVE-2026-60986
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
Risk Assessment
Risk of loss of confidentiality and integrity of project portfolio analysis data, potentially affecting investment and operational decisions.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Oracle E-Business Suite.
Other vulnerabilities in Oracle Project Portfolio Analysis
See all- CVE-2026-60988High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Despite high attack complexity, a low-privileged attacker with network access can take over the system, compromising confidentiality, integrity, and availability.
- CVE-2026-60987High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorizedly modify critical data and read a subset of data.
- CVE-2026-60985High
Vulnerability in Oracle Project Portfolio Analysis (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
- CVE-2026-60984High
Vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized modification of critical data and read some data.
- CVE-2026-46962High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Affected versions are 12.2.3-12.2.15.
- CVE-2026-46961High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Supported versions affected are 12.2.3-12.2.15.
- CVE-2026-46960High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to take over Oracle Project Portfolio Analysis. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).