EUVD-2026-37273Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP endpoint (AV:N), low complexity per Oracle (AC:L), requires a low-privileged EBS account (PR:L), no user interaction (UI:N), and full module takeover yields C:H/I:H/A:H within the same security authority (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Authenticated takeover of Oracle Project Portfolio Analysis (E-Business Suite versions 12.2.3 through 12.2.15) is possible over HTTP, allowing a low-privileged attacker to fully compromise the application's confidentiality, integrity, and availability. Oracle rates this as easily exploitable with a CVSS 3.1 base score of 8.8, though no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a valid low-privileged Oracle E-Business Suite account (PR:L) and have HTTP network reachability to the EBS application tier hosting Oracle Project Portfolio Analysis Internal Operations on a supported 12.2.3-12.2.15 deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a network-reachable, low-complexity attack requiring only a low-privileged authenticated session, yielding full CIA compromise - a strong prioritization signal for any organization exposing EBS to internal or external HTTP traffic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid low-privileged Oracle EBS account - for example a routine self-service or contractor account harvested through phishing or credential stuffing - sends a crafted HTTP request to the Project Portfolio Analysis Internal Operations endpoint and obtains full read/write/destructive control over the module's data and configuration. Because exploitation is rated low complexity over the network with no user interaction, the attacker can script the request to pivot from initial EBS foothold into portfolio financial data theft or sabotage. … |
| Remediation | Patch available per vendor advisory - apply the fixes shipped in the Oracle June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to all Oracle E-Business Suite 12.2.x environments running Project Portfolio Analysis, following Oracle's prerequisite patch baseline and standard EBS application-tier patching procedure (adop online or offline cycle). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory systems running Project Portfolio Analysis (versions 12.2.3-12.2.15) and restrict application access to essential administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover in Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) versions 12.2.3 t
Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today