This vulnerability affects Oracle Project Portfolio Analysis, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable network vulnerability requiring low privileges and no user interaction, allowing an attacker to compromise the system fully. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-46962 and is included in Oracle's June 2026 Critical Security Patch Update. Oracle's advisory does not specify a fixed version but strongly urges customers to apply the provided security patches promptly. No known exploits have been observed in the wild.

Successful exploitation can result in complete takeover of Oracle Project Portfolio Analysis, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt operations, and potentially affect dependent business processes.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. These mitigations may impact application functionality, so they should be applied carefully. No official patch version is explicitly stated in the advisory; therefore, customers should consult the Oracle Critical Security Patch Update documentation for exact patch availability and installation instructions.