CVE-2026-46960 affects Oracle Project Portfolio Analysis within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable vulnerability that permits a high privileged attacker with network access over HTTP to compromise the product, potentially resulting in full system takeover. The vulnerability is scored 7.2 on the CVSS 3.1 scale, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which addresses 245 new security patches across multiple Oracle products. Oracle strongly advises customers to apply these patches without delay. No explicit patch link or fix version is provided for this CVE in the advisory, and the remediation level is not stated. Oracle also suggests mitigating risk by blocking network protocols required for exploitation or removing unnecessary privileges from users, though these measures may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Project Portfolio Analysis, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTP to take over the affected product, potentially impacting business operations relying on Oracle E-Business Suite.

Oracle includes this vulnerability in its June 2026 Critical Security Patch Update and strongly recommends applying the update promptly to address this and other vulnerabilities. Since no explicit patch or fix version is stated for this CVE, customers should refer to the June 2026 Critical Security Patch Update advisory for patch availability and installation instructions. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these actions may disrupt application functionality. Customers should prioritize patching as the primary mitigation.