CVE-2026-60987
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorizedly modify critical data and read a subset of data.
Risk Assessment
Risk of unauthorized modification of critical project data and partial data exposure.
Recommendation
Apply the patch provided by Oracle for versions 12.2.3-12.2.15.
Other vulnerabilities in Oracle Project Portfolio Analysis
See all- CVE-2026-60988High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Despite high attack complexity, a low-privileged attacker with network access can take over the system, compromising confidentiality, integrity, and availability.
- CVE-2026-60986High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60985High
Vulnerability in Oracle Project Portfolio Analysis (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
- CVE-2026-60984High
Vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized modification of critical data and read some data.
- CVE-2026-46962High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Affected versions are 12.2.3-12.2.15.
- CVE-2026-46961High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Supported versions affected are 12.2.3-12.2.15.
- CVE-2026-46960High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to take over Oracle Project Portfolio Analysis. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).