This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable network vulnerability requiring low privileges and no user interaction. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Project Portfolio Analysis. Confidentiality and integrity of data are highly impacted, potentially allowing attackers to fully compromise data integrity and confidentiality within the affected product. Availability is not impacted. This could severely affect business operations relying on the integrity and confidentiality of project portfolio data.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a specific patch is confirmed, restrict network access to Oracle Project Portfolio Analysis and monitor for unusual activity. Follow Oracle's official security advisories for updates on patch availability.