This vulnerability affects Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system fully, resulting in takeover of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products. The vendor advisory emphasizes the importance of applying these patches without delay and notes that failure to patch has led to successful exploitation attempts. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, but these may disrupt application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to take over Oracle Project Portfolio Analysis, compromising confidentiality, integrity, and availability of the system. This can lead to full control over the affected product, potentially impacting business operations relying on this software.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches addressing this vulnerability. Customers are strongly advised to apply these patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.