CVE-2026-46961

HTTP-Based Privilege Escalation in Oracle Project Portfolio Analysis

Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

The vulnerability in Oracle Project Portfolio Analysis allows a low privileged attacker with network access via HTTP to compromise the application, potentially resulting in full takeover and affecting confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 indicates high severity. The weakness appears to stem from improper access control or authorization, permitting lower privileged users to elevate privileges and control the system.

Affected Systems

Oracle Corporation’s Oracle Project Portfolio Analysis, versions 12.2.3 through 12.2.15 are affected. The product is part of the Oracle E‑Business Suite internal operations component.

Risk and Exploitability

The CVSS score of 8.8 demonstrates a serious impact, but the EPSS score of less than 1 % indicates that exploitation is currently rare. The vulnerability is not listed in CISA KEV. The likely attack vector is via network HTTP from a low privileged user, and success would give the attacker full control over the application.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle Project Portfolio Analysis

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:project_portfolio_analysis:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Project Portfolio Analysis

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the security patch released in Oracle’s 2026 June alert to all affected instances of Oracle Project Portfolio Analysis.
If the patch is not immediately available, restrict or block low‑privileged user access to the HTTP interface of Oracle Project Portfolio Analysis until a fix can be applied.
Continuously monitor the application’s logs and network traffic for anomalous activity that could indicate an attempted takeover.

Generated by OpenCVE AI on June 18, 2026 at 23:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.411% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		HTTP-Based Privilege Escalation in Oracle Project Portfolio Analysis

Jun 18, 2026 10:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Low Privilege HTTP Exploit Compromises Oracle Project Portfolio Analysis
Weaknesses	CWE-284 CWE-285

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Low Privilege HTTP Exploit Compromises Oracle Project Portfolio Analysis
Weaknesses		CWE-269 CWE-284 CWE-285 CWE-287 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle project Portfolio Analysis
CPEs		cpe:2.3:a:oracle:project_portfolio_analysis::::::::
Vendors & Products		Oracle Oracle project Portfolio Analysis
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`