What is the CVSS score of EUVD-2026-47227?

EUVD-2026-47227 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47227?

Oracle Project Portfolio Analysis in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity vulnerability (CVE-2026-60986, CVSS 8.1) enabling low-privilege users to read, modify, or delete…

How to fix or mitigate EUVD-2026-47227?

Within 24 hours: identify all systems running Oracle EBS 12.2.3 through 12.2.15 with Project Portfolio Analysis enabled and implement immediate firewall rules restricting all HTTP access to trusted administrative networks only. Within 7 days: establish real-time authentication and access logging with alerting for anomalous Project Portfolio Analysis activity, conduct forensic review of recent access logs for indicators of compromise, reset credentials for all Project Portfolio Analysis user accounts, and disable the module if operationally feasible. Within 30 days: deploy the Oracle Critical Patch Update when released, validate patch installation across all instances, and conduct post-patch security validation testing.

Oracle E-Business Suite EUVD-2026-47227

| CVE-2026-60986 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m299-q578-6pfw

Authentication Bypass Oracle Project Portfolio Analysis

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a low-privileged authenticated EBS account (PR:L), low complexity, no UI; high confidentiality/integrity data impact and no availability effect, matching the vendor vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.

Technical ContextAI

Oracle Project Portfolio Analysis is a project-management/analytics module within the Oracle E-Business Suite (EBS) ERP platform, delivered through the EBS web tier over HTTP(S). The affected 'Internal Operations' component handles internal application operations exposed to authenticated EBS users. Oracle does not publish a CWE for CPU entries and CWE is listed as N/A here, but the vendor-supplied 'Authentication Bypass' tag combined with a horizontal/vertical data-access impact (unauthorized read and write to all module-accessible data) points to a broken access control / authorization flaw (CWE-284/CWE-863 class) rather than memory corruption. No CPE strings were supplied; affected products are identified from the EUVD version range (EBS 12.2.3 ≤ 12.2.15) only.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update; the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html is the authoritative source for the specific EBS 12.2 patch numbers, and no exact fixed version string was included in the input data so administrators should map their release (12.2.3-12.2.15) to the CPU-listed patch. As compensating controls until patching, restrict network reachability of the Oracle Project Portfolio Analysis / Internal Operations pages so they are not exposed to the public internet, place the EBS web tier behind a VPN or reverse proxy with strict access lists, tighten EBS responsibility/role assignments to reduce the number of low-privileged accounts that can reach the affected component, and enable enhanced auditing on Project Portfolio Analysis data access - noting these controls reduce exposure but do not eliminate the flaw for legitimate low-privileged users. Because exploitation requires an authenticated low-privileged session, promptly reviewing and de-provisioning stale EBS accounts also lowers risk.