This vulnerability affects Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 and arises from insufficient access control (CWE-284) in the product's internal operations component. An attacker with low privileges and network access via HTTP can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data within Oracle Project Portfolio Analysis. The vulnerability also allows causing a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No known exploits in the wild have been reported. Oracle has published a Critical Patch Update advisory in July 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided advisory content.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Project Portfolio Analysis, compromising data integrity. It also enables an attacker to cause a partial denial of service, impacting availability. Confidentiality is not affected. The vulnerability requires network access and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Project Portfolio Analysis instances where possible to limit exposure.