This vulnerability in Oracle Project Portfolio Analysis (component: Internal Operations) affects supported versions 12.2.3 through 12.2.15. It enables a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions a large set of patches but does not explicitly confirm patch availability or remediation level for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Project Portfolio Analysis, as well as unauthorized read access to a subset of accessible data. This compromises data integrity and confidentiality but does not affect availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60987. Customers should review the July 2026 Critical Patch Update advisory and apply relevant patches promptly if available. Until a patch is confirmed and applied, restrict network access to Oracle Project Portfolio Analysis instances to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.