This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix or remediation level for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Project Portfolio Analysis, as well as unauthorized read access to some data. This compromises data integrity and confidentiality but does not impact availability. The vulnerability is exploitable remotely over HTTP by an attacker with low privileges, increasing risk in network-exposed environments.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including those in Oracle products. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60984. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Project Portfolio Analysis interfaces to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.