What is the CVSS score of CVE-2026-61090?

CVE-2026-61090 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Project Foundation are affected by CVE-2026-61090?

Oracle Project Foundation (EBS 12.2.3-12.2.15) contains a high-severity local privilege escalation vulnerability enabling complete application compromise; no public exploit identified at time of…

How to fix or mitigate CVE-2026-61090?

Within 24 hours, identify all Oracle E-Business Suite installations running Project Foundation (versions 12.2.3 through 12.2.15) and document which systems permit low-privileged users local logon access. Within 7 days, restrict local system access to Project Foundation infrastructure to essential administrators only, enable comprehensive audit logging of Project Foundation activities, and validate compensating controls are functioning. Within 30 days, obtain and test the Oracle July 2026 Critical Patch Update in a pre-production environment matching your Project Foundation 12.2.x configuration, then deploy to all affected production systems.

Oracle Project Foundation CVE-2026-61090

EUVD-2026-47301 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-9335-6wrx-cvpc

Privilege Escalation Oracle E Business Suite

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local logon and a low-privilege account are required (AV:L, PR:L), complexity is low with no user interaction, and outcome is full component takeover (C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Project Foundation executes to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Project Foundation. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Project Foundation is a core shared-services module within Oracle E-Business Suite (EBS), providing the underlying data model, security, and infrastructure for the Oracle Projects suite (Project Costing, Billing, Management, etc.). The flaw sits in the 'Miscellaneous' component and affects the 12.2.x application-tier release line (12.2.3-12.2.15). Oracle did not assign a specific CWE (CWE: N/A) and does not disclose the root-cause class, but the CVSS vector (AV:L, PR:L, C:H/I:H/A:H) is consistent with a privilege-escalation or unsafe-local-operation weakness that an authenticated OS/application user on the EBS infrastructure can abuse. The 'Information Disclosure' tag aligns with the high confidentiality impact, though the full C/I/A impact indicates the outcome goes beyond disclosure to complete component takeover.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue - see the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the corresponding EBS 12.2 patch for your release level (Patch available per Oracle vendor advisory; a discrete fixed version string was not published in the input, as Oracle ships fixes as cumulative CPU patches rather than tagged releases). Because exploitation requires local logon access, effective compensating controls until patching is complete include restricting and auditing interactive/OS-level and low-privilege application accounts on EBS application-tier hosts, minimizing the number of users with logon to the infrastructure, and enforcing least privilege on shared accounts - the trade-off is operational friction for administrators and integration jobs that legitimately need host access. Do not rely on network/perimeter controls alone, as the vector is local rather than network-based.