Oracle Project Portfolio Analysis CVE-2026-46962

Attacker must hold a valid low-privileged Oracle E-Business Suite account (PR:L) and have HTTP network reachability to the EBS application tier hosting Oracle Project Portfolio Analysis Internal Operations on a supported 12.2.3-12.2.15 deployment. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any authenticated EBS user - including self-service or read-only responsibilities - appears sufficient. Exploitation is limited by the requirement that the Project Portfolio Analysis module be licensed and deployed (it is not enabled in every EBS install), that the attacker possess working application credentials, and that they can reach the application HTTP listener (often firewalled to internal networks in mature deployments).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a network-reachable, low-complexity attack requiring only a low-privileged authenticated session, yielding full CIA compromise - a strong prioritization signal for any organization exposing EBS to internal or external HTTP traffic. The vulnerability is not on the CISA KEV list and no EPSS score, SSVC decision, or POC link was supplied, so widespread automated exploitation is not currently evidenced; however, Oracle EBS modules have historically been a high-value target for ransomware and data-theft actors following each CPU release, so the 'low PR' barrier (any application user) makes opportunistic exploitation very plausible once technical details are reverse-engineered from the patch. Note that the only reference is Oracle's own advisory - independent confirmation from NVD enrichment (CWE, EPSS, KEV) was not present in the input, so the risk picture is based primarily on Oracle's self-reported metrics.

An attacker with any valid low-privileged Oracle EBS account - for example a routine self-service or contractor account harvested through phishing or credential stuffing - sends a crafted HTTP request to the Project Portfolio Analysis Internal Operations endpoint and obtains full read/write/destructive control over the module's data and configuration. Because exploitation is rated low complexity over the network with no user interaction, the attacker can script the request to pivot from initial EBS foothold into portfolio financial data theft or sabotage. No public exploit identified at time of analysis, so weaponization would currently require independent patch-diff or reverse-engineering effort.