What is the CVSS score of CVE-2026-60901?

CVE-2026-60901 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Project Intelligence are affected by CVE-2026-60901?

Oracle Project Intelligence within E-Business Suite versions 12.2.3-12.2.15 is vulnerable to privilege escalation that allows low-privileged users to achieve complete component compromise, enabling…

How to fix or mitigate CVE-2026-60901?

Within 24 hours, identify and enumerate all Oracle EBS 12.2.3-12.2.15 deployments in your infrastructure and assess which support business-critical functions; immediately notify system owners and establish communication with your Oracle support team. Within 7 days, apply the July 2026 Critical Patch Update to non-production instances, execute functional regression testing of core Project Intelligence workflows, and document patch deployment procedures. Within 30 days, roll out patches across all production systems, validate exploit vectors are fully mitigated, and update asset management records with patched versions.

Project Intelligence CVE-2026-60901

EUVD-2026-47176 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-9xvf-pff2-ccqw

Privilege Escalation Oracle Project Intelligence

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle Project Intelligence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.