CVE-2026-46960 affects Oracle Project Portfolio Analysis within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The vulnerability permits a high privileged attacker with network access via HTTP to compromise the system, potentially resulting in full product takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 fixes but does not specify a distinct patch version for this issue. Oracle strongly recommends applying the Critical Security Patch Update promptly to address this and other vulnerabilities. Workarounds include blocking attack-related network protocols and restricting privileges, though these may impair application functionality.

Successful exploitation of CVE-2026-46960 can lead to complete compromise of Oracle Project Portfolio Analysis, affecting confidentiality, integrity, and availability of the system. This could enable an attacker with high privileges and network access to take over the product, potentially disrupting business operations and exposing sensitive data.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is not explicitly confirmed for this specific vulnerability beyond the general advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.