What is the CVSS score of CVE-2026-60988?

CVE-2026-60988 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60988?

Organizations running Oracle E-Business Suite versions 12.2.3 through 12.2.15 face critical risk of complete unauthorized access to their Project Portfolio Analysis module and internal operations…

How to fix or mitigate CVE-2026-60988?

Within 24 hours, identify all systems running Oracle EBS versions 12.2.3-12.2.15 and immediately restrict access to the Project Portfolio Analysis module to essential personnel only; enable comprehensive audit logging for all access and changes within the module and escalate any suspicious authentication attempts to the security team. Within 7 days, conduct a full security assessment of affected systems for indicators of compromise, implement network-level isolation for Oracle EBS instances where feasible, and establish a rapid-response incident handling plan specific to this vulnerability. Within 30 days, evaluate available mitigation options including upgrade paths to unpatched versions, enforce multi-factor authentication for all module access, maintain continuous monitoring for exploitation attempts, and coordinate with Oracle to track patch release timelines.

Oracle E-Business Suite CVE-2026-60988

EUVD-2026-47229 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-cr6x-jm36-mmmj

Privilege Escalation Oracle Project Portfolio Analysis

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachability gives AV:N; Oracle's 'difficult to exploit' plus required low-privileged account justify AC:H and PR:L; full module takeover yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Oracle Project Portfolio Analysis is a module within the Oracle Projects family of Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP application suite built on the Oracle Database and Oracle Application Server / WebLogic middleware stack. The affected component is 'Internal Operations,' and access is via HTTP, consistent with EBS's web-based self-service architecture. The specific root cause class is not identified because the CWE is listed as N/A in the source data and Oracle's Critical Patch Update advisories characteristically omit technical vulnerability detail; the vendor tag 'Information Disclosure' hints at a data-exposure element, though the CVSS impact set (C:H/I:H/A:H) and Oracle's own 'takeover' language indicate a far broader consequence than disclosure alone.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as CPU patches referenced by the July 2026 release rather than a single named product version, so consult the CPU advisory's patch matrix for the exact patch numbers matching your 12.2.x level and apply them through AD/adop online patching. Because exploitation requires network HTTP access and a low-privileged account, meaningful compensating controls while patching include restricting the Project Portfolio Analysis and Internal Operations pages to trusted networks or VPN, placing the EBS web tier behind a reverse proxy or WAF and removing direct internet exposure, and tightening EBS user provisioning and responsibility assignments to reduce the pool of accounts that could reach the vulnerable functionality - noting each of these can disrupt legitimate remote or self-service users and should be validated against business workflows.