Project Portfolio Analysis
Monthly
Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.
Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.
Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.
Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.
Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.