This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability or provide a remediation level. Users are urged to review the advisory and apply relevant patches promptly.

Successful exploitation allows an attacker with low privileges and network access to perform unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Project Portfolio Analysis. Additionally, the attacker can gain unauthorized read access to some data. This compromises the confidentiality and integrity of the affected system's data but does not impact availability. The vulnerability's CVSS score of 7.1 reflects a high severity due to these impacts.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability, Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Users should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and installation instructions. Patch status is not yet confirmed for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.