This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is classified under CWE-284 (Improper Access Control). The flaw allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts to confidentiality (low) and integrity (high), with no impact on availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Users are strongly advised to apply Oracle Critical Patch Updates without delay to mitigate this and other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within Oracle Project Portfolio Analysis, as well as unauthorized read access to some data. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

The vendor advisory does not explicitly confirm a patch for this vulnerability but strongly recommends applying Oracle Critical Patch Updates promptly. Users should review the July 2026 Critical Patch Update advisory and apply all relevant patches for Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15. Maintaining up-to-date patches is the primary mitigation. No alternative or temporary mitigations are specified by the vendor.