Oracle E-Business Suite CVE-2026-60986

Exploitation requires network HTTP access to an Oracle E-Business Suite instance running the Project Portfolio Analysis product (Internal Operations component) at a version between 12.2.3 and 12.2.15, plus a valid low-privileged EBS account (CVSS PR:L - some authentication is required despite the vendor 'Authentication Bypass' tag). No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already hold or obtain a low-privileged EBS login, the target must have the Project Portfolio Analysis module deployed and reachable over HTTP, and only in-scope versions 12.2.3-12.2.15 are affected; instances restricted to internal networks or without this module deployed are not remotely exposed.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N yields 8.1 (High): network attack vector, low complexity, low privileges required, no user interaction, with high confidentiality and integrity impact and no availability impact. Oracle explicitly describes it as 'easily exploitable' by a low-privileged attacker, which is consistent with AC:L/PR:L. However, exploitation still requires a valid low-privileged EBS account (PR:L), so this is not an unauthenticated internet-wide risk despite the 'Authentication Bypass' tag - the two signals appear to conflict and should be verified against Oracle's advisory, since PR:L in the official vector means some authentication is required. No EPSS score, no SSVC decision, no POC, and no KEV entry were provided, so real-world exploitation probability cannot be quantified from the input. Net: a genuinely high-severity ERP data-exposure flaw that warrants prompt patching for internet-facing or large-user-base EBS deployments, but current evidence does not indicate active exploitation.

A low-privileged user with a valid Oracle EBS account (for example an internal employee or a compromised low-tier login) sends crafted HTTP requests to the Project Portfolio Analysis Internal Operations component and, by abusing the missing authorization check, reads and modifies project and financial data they should not be able to touch. No user interaction or elevated privileges are needed and attack complexity is low, so a single authenticated session is sufficient; no public exploit code has been identified at time of analysis.