Description
Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Intelligence accessible data as well as unauthorized read access to a subset of Oracle Project Intelligence accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Manipulation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a low‑privileged attacker who can reach the Oracle Project Intelligence web interface over HTTP to create, delete, or modify critical data and read a subset of accessible data. This results in a breach of confidentiality and integrity for the affected database. The weakness stems from an improper access control mechanism, which is represented as CWE‑284.

Affected Systems

The flaw affects Oracle Corporation's Oracle Project Intelligence, part of Oracle E‑Business Suite, for supported releases ranging from 12.2.3 through 12.2.15. No other product versions are listed as susceptible.

Risk and Exploitability

The CVSS 3.1 base score of 7.1 indicates a moderate to high severity, with a low‑privileged attacker required and no user interaction. The EPSS score of less than 1% suggests exploitation probability remains low, and the vulnerability does not appear in the CISA KEV catalog. Nevertheless, because the flaw permits unauthorized data manipulation via a common network protocol, it poses a significant threat to systems exposed to networking.

Generated by OpenCVE AI on September 17, 2026 at 01:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Project Intelligence security patch referenced in the security alert.
  • Restrict HTTP access to the Project Intelligence interface to trusted IP addresses or VPN endpoints.
  • Review and tighten role‑based access controls to ensure low‑privileged accounts cannot create, delete, or modify critical data.

Generated by OpenCVE AI on September 17, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Access in Oracle Project Intelligence via HTTP
Weaknesses CWE-284
CWE-862

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Intelligence accessible data as well as unauthorized read access to a subset of Oracle Project Intelligence accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
First Time appeared Oracle
Oracle project Intelligence
CPEs cpe:2.3:a:oracle:project_intelligence:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle project Intelligence
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Oracle Project Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:16:58.162Z

Reserved: 2026-08-31T15:40:57.343Z

Link: CVE-2026-83161

cve-icon Vulnrichment

Updated: 2026-09-17T14:22:49.045Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:27.007

Modified: 2026-09-17T16:18:06.417

Link: CVE-2026-83161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T01:30:08Z

Weaknesses