This vulnerability affects Oracle Project Portfolio Analysis within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is classified under CWEs related to improper access control and authorization (CWE-306, CWE-269, CWE-284). The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying patches promptly, but patch availability for this issue is not explicitly stated.

Successful exploitation can lead to full takeover of Oracle Project Portfolio Analysis, compromising confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, but the attack complexity is high. This could allow unauthorized control over the affected product.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends remaining on actively supported versions and applying security patches without delay once available. No specific temporary mitigations or workarounds are provided in the advisory.