What is the CVSS score of CVE-2026-60985?

CVE-2026-60985 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Project Portfolio Analysis are affected by CVE-2026-60985?

Oracle Project Portfolio Analysis (E-Business Suite versions 12.2.3-12.2.15) contains a high-severity vulnerability enabling authenticated attackers to tamper with or delete project data and cause…

How to fix or mitigate CVE-2026-60985?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with the Project Portfolio Analysis module enabled and prioritize systems managing critical project data. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems after validation in a staging environment. Within 30 days, complete patching of all production and non-production instances, verify successful deployment, and conduct a data integrity audit to identify any unauthorized modifications.

Project Portfolio Analysis CVE-2026-60985

EUVD-2026-47226 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-36m8-g746-w6jf

Authentication Bypass Denial Of Service Oracle Project Portfolio Analysis

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

AnalysisAI

Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.