Oracle Project Foundation CVE-2026-61090

Exploitation requires the attacker to already have a low-privileged account with logon access to the infrastructure/host where Oracle Project Foundation executes (CVSS AV:L, PR:L) - it cannot be triggered remotely over the network by an unauthenticated user. The affected deployment must be Oracle E-Business Suite running Oracle Project Foundation at a version between 12.2.3 and 12.2.15. Limiting factors that reduce realistic risk: local logon access is a hard prerequisite, so the exposed population is confined to users who already have accounts on EBS hosts; no special non-default feature toggle is documented by Oracle. No user interaction is needed once local access exists (UI:N), and attack complexity is low (AC:L), so among those with local access the exploit is straightforward.

The CVSS 3.1 base score is 7.8 (High), driven by high impact across all three dimensions (C:H/I:H/A:H) combined with low attack complexity (AC:L) and no user interaction (UI:N). The key limiting factor is the local attack vector (AV:L) and the requirement for existing low-privilege access (PR:L) - this is not a remotely exploitable, unauthenticated internet-facing flaw, so mass exploitation is unlikely and the real-world urgency is lower than the 7.8 headline suggests. No EPSS score, KEV listing, POC, or SSVC data was provided in the input; absence of these signals is not proof of low risk, but no active exploitation or public exploit is confirmed. Practical risk is meaningful for organizations where many users hold logon access to EBS hosts (shared application tiers, contractors, or broad OS accounts), where a low-privileged insider or a foothold from another compromise could escalate to full control of Project Foundation.

An attacker who already holds a low-privileged account with logon access to the Oracle E-Business Suite application-tier host - for example an insider, a contractor, or an intruder who gained an initial low-value foothold - leverages the flaw in the Project Foundation Miscellaneous component to escalate to full control of the module. Because attack complexity is low and no user interaction is required, the operation is reliable once local access is obtained. No public proof-of-concept was identified at time of analysis.