Oracle Project Portfolio Analysis CVE-2026-46960

Attacker must already hold high-privileged EBS access (CVSS PR:H) and be able to reach the Project Portfolio Analysis Internal Operations HTTP endpoints over the network; no user interaction is required. The target must be Oracle E-Business Suite 12.2.3 through 12.2.15 with the Project Portfolio Analysis module licensed and deployed - environments that do not enable this EBS module are not exposed. Limiting factors: privilege precondition rules out anonymous internet attackers, EBS instances commonly sit behind VPN/SSO so HTTP reachability for outsiders is typically constrained, and only the Project Portfolio Analysis component is in scope per Oracle's advisory.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the combination of unrestricted impact (full takeover of the module) with the significant precondition of high privileges - an attacker must already hold administrative-grade access in the EBS environment, which sharply narrows the realistic attacker pool to insiders or actors who have already compromised privileged credentials. There is no EPSS score, KEV listing, or POC indicator in the provided data, and no CWE attribution from the vendor, so exploitation likelihood signals beyond CVSS are absent. Realistically this should be treated as an important EBS patching item rather than an internet-edge emergency: the network attack vector looks alarming, but PR:H means it is not exploitable by an anonymous remote attacker, and the lack of any exploitation telemetry in the inputs argues against treating it as drop-everything-now.

An attacker who has already obtained or abused high-privileged EBS credentials - for example a compromised functional administrator or a malicious insider - sends crafted HTTP requests to the Project Portfolio Analysis Internal Operations endpoints and leverages the flaw to fully take over the module, reading and modifying project portfolio data and disrupting its availability. No public exploit identified at time of analysis, so any near-term exploitation would most plausibly be opportunistic post-credential-theft abuse rather than a turnkey exploit chain.