CVE-2026-60988
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Despite high attack complexity, a low-privileged attacker with network access can take over the system, compromising confidentiality, integrity, and availability.
Risk Assessment
Risk of full system takeover of project portfolio analysis, potentially leading to data loss, business disruption, and security breaches.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Oracle E-Business Suite.
Other vulnerabilities in Oracle Project Portfolio Analysis
See all- CVE-2026-60987High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorizedly modify critical data and read a subset of data.
- CVE-2026-60986High
Vulnerability in Oracle Project Portfolio Analysis (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60985High
Vulnerability in Oracle Project Portfolio Analysis (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can modify data and cause partial DOS.
- CVE-2026-60984High
Vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) versions 12.2.3-12.2.15. Easily exploitable, allows a low-privileged attacker via HTTP to gain unauthorized modification of critical data and read some data.
- CVE-2026-46962High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Affected versions are 12.2.3-12.2.15.
- CVE-2026-46961High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Supported versions affected are 12.2.3-12.2.15.
- CVE-2026-46960High
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to take over Oracle Project Portfolio Analysis. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).