What is the CVSS score of EUVD-2026-37271?

EUVD-2026-37271 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Project Portfolio Analysis are affected by EUVD-2026-37271?

Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 face a high-severity vulnerability enabling insiders with administrative credentials to completely compromise the application and…

How to fix or mitigate EUVD-2026-37271?

24 hours: Identify and document all Oracle Project Portfolio Analysis instances running versions 12.2.3 through 12.2.15 in the environment. 7 days: Implement network access controls restricting HTTP traffic to affected systems, enforce enhanced logging and alerting on high-privileged user activity, and apply principle of least privilege to reduce administrative accounts. 30 days: Develop an upgrade plan to versions above 12.2.15, establish ongoing monitoring of Oracle security advisories for patch releases, and conduct a comprehensive access review to eliminate unnecessary elevated role assignments.

Oracle Project Portfolio Analysis EUVD-2026-37271

| CVE-2026-46960 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Project Portfolio Analysis Authentication Bypass

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable EBS endpoint (AV:N/AC:L), exploitation requires existing high-privileged EBS account (PR:H), no user interaction, full module takeover gives C:H/I:H/A:H within the same scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible by an authenticated high-privileged attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15. The flaw yields complete confidentiality, integrity, and availability impact on the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Project Portfolio Analysis is a module of the Oracle E-Business Suite (EBS) 12.2 family, used to prioritize project investments against strategic goals; the affected sub-component is Internal Operations, which handles back-office administrative flows within EBS. The CPE entry cpe:2.3:a:oracle_corporation:oracle_project_portfolio_analysis covers all release branches in the 12.2.x train. No CWE was assigned by Oracle in the published Critical Patch Update entry, which is typical of EBS advisories that withhold root-cause detail; based on the vector (network/HTTP with high privileges leading to full CIA loss) the class is consistent with an authenticated server-side application logic or injection weakness exposed through an authenticated EBS HTTP endpoint.

RemediationAI

Apply the fixes shipped in the Oracle June 2026 Critical Security Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to all EBS 12.2.x instances running Project Portfolio Analysis; exact patch numbers per release line are listed in the CPU advisory matrix and should be sourced directly from Oracle Support rather than inferred. Until the CPU bundle is applied, restrict access to the Project Portfolio Analysis Internal Operations URLs at the EBS reverse proxy or load balancer, audit and reduce the population of high-privileged EBS accounts (this constrains who can reach the precondition state but does not block legitimate privileged users from triggering it), and enforce MFA on all administrative EBS logins to make credential compromise harder, accepting the operational trade-off that workflow-tool integrations using static credentials may need to be re-tooled.