Description
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-06-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Oracle Project Portfolio Analysis allows a low privileged attacker with network access via HTTP to compromise the application, potentially resulting in full takeover and affecting confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 indicates high severity. The weakness appears to stem from improper access control or authorization, permitting lower privileged users to elevate privileges and control the system.

Affected Systems

Oracle Corporation’s Oracle Project Portfolio Analysis, versions 12.2.3 through 12.2.15 are affected. The product is part of the Oracle E‑Business Suite internal operations component.

Risk and Exploitability

The CVSS score of 8.8 demonstrates a serious impact, but the EPSS score of less than 1 % indicates that exploitation is currently rare. The vulnerability is not listed in CISA KEV. The likely attack vector is via network HTTP from a low privileged user, and success would give the attacker full control over the application.

Generated by OpenCVE AI on June 18, 2026 at 23:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the security patch released in Oracle’s 2026 June alert to all affected instances of Oracle Project Portfolio Analysis.
  • If the patch is not immediately available, restrict or block low‑privileged user access to the HTTP interface of Oracle Project Portfolio Analysis until a fix can be applied.
  • Continuously monitor the application’s logs and network traffic for anomalous activity that could indicate an attempted takeover.

Generated by OpenCVE AI on June 18, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 19 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title HTTP-Based Privilege Escalation in Oracle Project Portfolio Analysis

Thu, 18 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromises Oracle Project Portfolio Analysis
Weaknesses CWE-284
CWE-285

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromises Oracle Project Portfolio Analysis
Weaknesses CWE-269
CWE-284
CWE-285
CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle project Portfolio Analysis
CPEs cpe:2.3:a:oracle:project_portfolio_analysis:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle project Portfolio Analysis
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Project Portfolio Analysis
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-06-17T18:24:43.813Z

Reserved: 2026-05-18T15:55:10.314Z

Link: CVE-2026-46961

cve-icon Vulnrichment

Updated: 2026-06-17T18:23:39.901Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:04:41Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function