This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, as well as causing a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

The vulnerability allows unauthorized modification of critical data or all accessible data in Oracle Project Portfolio Analysis and can cause a partial denial of service. This impacts data integrity and availability but does not affect confidentiality. The attack requires network access and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Project Portfolio Analysis and monitor for suspicious activity related to unauthorized data modification or service disruption.