What is the CVSS score of EUVD-2026-47228?

EUVD-2026-47228 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47228?

Oracle Project Portfolio Analysis (versions 12.2.3-12.2.15) contains a data tampering vulnerability enabling low-privileged network attackers to create, delete, or modify critical business data; no…

How to fix or mitigate EUVD-2026-47228?

Within 24 hours, inventory all systems running Oracle Project Portfolio Analysis 12.2.3-12.2.15 and assess which host sensitive project or financial data. Within 7 days, restrict HTTP network access to the affected module via firewall rules, enable audit logging of all data modifications, and verify data integrity in production. Within 30 days, monitor Oracle security advisories for patch availability-no vendor-released patch identified at time of analysis-and develop an upgrade plan to version 12.2.16 or later.

Oracle E-Business Suite EUVD-2026-47228

| CVE-2026-60987 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x39f-h6p9-796c

Authentication Bypass Oracle Project Portfolio Analysis

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network-reachable HTTP endpoint (AV:N/AC:L), requires a low-privileged authenticated EBS account (PR:L), no UI; high integrity from data modification, limited read (C:L), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Oracle E-Business Suite, Oracle's large integrated ERP/CRM application suite, specifically the Project Portfolio Analysis module within the Projects family, exposed over HTTP through the EBS web tier. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is not published; however, the CVSS profile (network vector, low complexity, requires an authenticated low-privileged EBS session, high integrity impact, low confidentiality impact) is consistent with a broken access-control or authorization flaw allowing an under-privileged user to reach data-modifying operations. The 'Internal Operations' component designation and the affected 12.2.x release line indicate this lies in the EBS 12.2 application code rather than the underlying database or middleware.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set and version applicable to your EBS 12.2.3-12.2.15 deployment. Patch available per vendor advisory; an exact standalone fix version string was not included in the input data, so identify the specific CPU patch number from the advisory matrix for Project Portfolio Analysis. Because exploitation requires an authenticated low-privileged session, compensating controls until patching include tightening EBS user provisioning and removing unnecessary low-privilege accounts, restricting network access to the EBS web tier so that only trusted internal users can reach the Project Portfolio Analysis HTTP endpoints (for example via reverse-proxy allowlisting or VPN gating, which may inconvenience remote users), and enabling monitoring of unexpected create/delete/modify activity on Project Portfolio data - none of these fully remove the flaw and should be treated as interim measures only.