EUVD-2026-37272Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv EBS account
-
DeliveryReach EBS web tier over HTTP
-
ExploitAuthenticate to Project Portfolio Analysis
-
ExecutionSend crafted Internal Operations request
-
PersistExploit authorization/injection flaw
-
ImpactTake over Project Portfolio Analysis module
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess valid credentials for any low-privileged Oracle E-Business Suite 12.2 account that can authenticate to the Project Portfolio Analysis module's Internal Operations component over HTTP/HTTPS, and must have network reachability to the EBS web tier (Oracle HTTP Server / WebLogic forms or OA Framework URLs). No user interaction, no admin role, and no non-default configuration are required - the module is part of standard EBS 12.2 installs. Exploitation is limited to environments running supported releases 12.2.3 through 12.2.15 with Project Portfolio Analysis licensed/enabled; deployments that have firewalled the EBS web tier away from general users or disabled the module materially reduce exposure. |
| Impact | This is a genuine priority for any EBS 12.2 operator: CVSS 8.8 with AV:N/AC:L/PR:L/UI:N means a single low-privileged EBS account (any self-service or named portfolio user) can fully take over the module over HTTP, and EBS web tiers are frequently reachable from intranet or partner networks. No EPSS score, KEV listing, or public PoC was provided, so exploitation pressure today appears low, but Oracle's own wording 'easily exploitable' and the universal impact on 12.2.3-12.2.15 mean weaponization after CPU release is plausible. The absence of a CWE and any technical detail beyond Oracle's CPU note is a known gap with Oracle advisories - defenders should treat the CVSS vector as authoritative and assume any authenticated EBS user is a viable attack origin. |
| Exploit ScenarioDerived | An attacker who has phished or otherwise obtained any low-privileged Oracle EBS account logs into the Project Portfolio Analysis self-service interface and sends a crafted HTTP request to an Internal Operations endpoint. Because no user interaction is required and complexity is low, a single request chain elevates the attacker to full read/write/destroy control of the module, enabling manipulation of project financial data or use of the module as a pivot into the wider EBS stack. No public exploit identified at time of analysis, but the CVSS profile suggests a script-based PoC would be straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover in Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the module over HTTP. Oracle's June 2026 Critical Patch Update rates the issue 8.8 with high confidentiality, integrity, and availability impacts, and the CVSS vector flags it as easily exploitable; no public exploit identified at time of analysis and the issue is not on CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update of June 2026 for Oracle E-Business Suite 12.2 as described at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle does not publish per-CVE point versions, so install the CPU bundle covering Project Portfolio Analysis on all 12.2.3-12.2.15 environments. Until the CPU is applied, restrict network reachability of the EBS web tier to trusted corporate ranges via firewall or reverse-proxy ACLs, disable the Project Portfolio Analysis responsibility for non-essential users, and tighten EBS account provisioning so low-privileged accounts cannot reach the Internal Operations functions; note that responsibility removal will block legitimate portfolio workflows and network restriction may break partner or VPN-less access, so coordinate with finance owners before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Project Portfolio Analysis is a financial planning module of the Oracle E-Business Suite (EBS) 12.2 application stack, exposed through the EBS web tier (Oracle HTTP Server / WebLogic forms and OA Framework) and the Internal Operations component which handles internal portfolio and project administration workflows. The affected releases (12.2.3-12.2.15) cover the entire 12.2 maintenance line, indicating a long-lived defect in the module's HTTP-facing logic. No CWE was assigned by Oracle, but the CVSS profile (network, low complexity, low privileges, no user interaction, unchanged scope, full CIA impact) is characteristic of authenticated injection or authorization-bypass flaws commonly seen in EBS modules.
Know when Oracle Project Portfolio Analysis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Oracle states network HTTP access with a low-privileged account and no user interaction yields full takeover of the module, so AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Project Portfolio Analysis versions 12.2.3-12.2.15 contain an account takeover vulnerability that allows low-privileged authenticated users to fully compromise project data and operations; organizations running affected versions face immediate risk of unauthorized data access, modification, and service disruption. Without a vendor-issued patch available, immediate access control and monitoring measures are critical. Affected organizations must inventory systems and implement emergency restrictions within 24 hours.
Restrict HTTP access to PPA modules to approved administrative users only via firewall and proxy controls; implement IP whitelisting for PPA endpoints; enforce HTTPS-only connectivity and disable HTTP access where possible; require enhanced authentication (MFA or additional credential verification) for all PPA module access; implement real-time logging and alerting on PPA access events, privilege changes, and login anomalies; conduct daily access reviews and log audits until patch is deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authenticated takeover of Oracle Project Portfolio Analysis (E-Business Suite versions 12.2.3 through 12.2.15) is possib
Full product takeover of Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) is possible
GitHub PoC
Exploit-DB