What is the CVSS score of CVE-2026-46960?

CVE-2026-46960 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Project Portfolio Analysis are affected by CVE-2026-46960?

Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 face a high-severity vulnerability enabling insiders with administrative credentials to completely compromise the application and…

How to fix or mitigate CVE-2026-46960?

24 hours: Identify and document all Oracle Project Portfolio Analysis instances running versions 12.2.3 through 12.2.15 in the environment. 7 days: Implement network access controls restricting HTTP traffic to affected systems, enforce enhanced logging and alerting on high-privileged user activity, and apply principle of least privilege to reduce administrative accounts. 30 days: Develop an upgrade plan to versions above 12.2.15, establish ongoing monitoring of Oracle security advisories for patch releases, and conduct a comprehensive access review to eliminate unnecessary elevated role assignments.

Oracle Project Portfolio Analysis CVE-2026-46960

EUVD-2026-37271 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Project Portfolio Analysis Authentication Bypass

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable EBS endpoint (AV:N/AC:L), exploitation requires existing high-privileged EBS account (PR:H), no user interaction, full module takeover gives C:H/I:H/A:H within the same scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible by an authenticated high-privileged attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15. The flaw yields complete confidentiality, integrity, and availability impact on the application. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain high-privileged EBS credentials

Delivery

Reach Project Portfolio Analysis HTTP endpoint

Exploit

Send crafted Internal Operations request

Execution

Trigger module takeover

Impact

Read and tamper with portfolio data

Access

Obtain high-privileged EBS credentials

Delivery

Reach Project Portfolio Analysis HTTP endpoint

Exploit

Send crafted Internal Operations request

Execution

Trigger module takeover

Impact

Read and tamper with portfolio data

Vulnerability AssessmentAI

Exploitation	Attacker must already hold high-privileged EBS access (CVSS PR:H) and be able to reach the Project Portfolio Analysis Internal Operations HTTP endpoints over the network; no user interaction is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the combination of unrestricted impact (full takeover of the module) with the significant precondition of high privileges - an attacker must already hold administrative-grade access in the EBS environment, which sharply narrows the realistic attacker pool to insiders or actors who have already compromised privileged credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has already obtained or abused high-privileged EBS credentials - for example a compromised functional administrator or a malicious insider - sends crafted HTTP requests to the Project Portfolio Analysis Internal Operations endpoints and leverages the flaw to fully take over the module, reading and modifying project portfolio data and disrupting its availability. No public exploit identified at time of analysis, so any near-term exploitation would most plausibly be opportunistic post-credential-theft abuse rather than a turnkey exploit chain.
Remediation	Apply the fixes shipped in the Oracle June 2026 Critical Security Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to all EBS 12.2.x instances running Project Portfolio Analysis; exact patch numbers per release line are listed in the CPU advisory matrix and should be sourced directly from Oracle Support rather than inferred. … Detailed patch versions, workarounds, and compensating controls in full report.