What is the CVSS score of EUVD-2026-37272?

EUVD-2026-37272 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Project Portfolio Analysis are affected by EUVD-2026-37272?

Oracle Project Portfolio Analysis versions 12.2.3-12.2.15 contain an account takeover vulnerability that allows low-privileged authenticated users to fully compromise project data and operations;…

How to fix or mitigate EUVD-2026-37272?

24 hours: Identify all systems running Oracle PPA 12.2.3-12.2.15 in production and test environments; restrict HTTP access to PPA modules to administrative personnel only via firewall rules; audit current user privilege assignments in affected instances. 7 days: Engage Oracle Support for guidance on interim mitigation or planned patch timeline; implement network segmentation isolating PPA from general user access; review and preserve PPA module access logs from the past 60 days for forensic investigation. 30 days: Upgrade all instances to versions outside the 12.2.3-12.2.15 range, or apply an Oracle-issued security patch when available; conduct complete privilege review to enforce least-privilege access to PPA modules.

Oracle Project Portfolio Analysis EUVD-2026-37272

| CVE-2026-46961 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Project Portfolio Analysis Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Oracle states network HTTP access with a low-privileged account and no user interaction yields full takeover of the module, so AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle Project Portfolio Analysis. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Project Portfolio Analysis (E-Business Suite component Internal Operations) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the module over HTTP. Oracle's June 2026 Critical Patch Update rates the issue 8.8 with high confidentiality, integrity, and availability impacts, and the CVSS vector flags it as easily exploitable; no public exploit identified at time of analysis and the issue is not on CISA KEV.

Technical ContextAI

Oracle Project Portfolio Analysis is a financial planning module of the Oracle E-Business Suite (EBS) 12.2 application stack, exposed through the EBS web tier (Oracle HTTP Server / WebLogic forms and OA Framework) and the Internal Operations component which handles internal portfolio and project administration workflows. The affected releases (12.2.3-12.2.15) cover the entire 12.2 maintenance line, indicating a long-lived defect in the module's HTTP-facing logic. No CWE was assigned by Oracle, but the CVSS profile (network, low complexity, low privileges, no user interaction, unchanged scope, full CIA impact) is characteristic of authenticated injection or authorization-bypass flaws commonly seen in EBS modules.

RemediationAI

Patch available per vendor advisory: apply the Oracle Critical Patch Update of June 2026 for Oracle E-Business Suite 12.2 as described at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle does not publish per-CVE point versions, so install the CPU bundle covering Project Portfolio Analysis on all 12.2.3-12.2.15 environments. Until the CPU is applied, restrict network reachability of the EBS web tier to trusted corporate ranges via firewall or reverse-proxy ACLs, disable the Project Portfolio Analysis responsibility for non-essential users, and tighten EBS account provisioning so low-privileged accounts cannot reach the Internal Operations functions; note that responsibility removal will block legitimate portfolio workflows and network restriction may break partner or VPN-less access, so coordinate with finance owners before enforcing.