This vulnerability affects Oracle Project Portfolio Analysis component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is classified as difficult to exploit. Oracle has published this issue in their July 2026 Critical Patch Update advisory but has not explicitly stated patch availability or remediation instructions for this specific vulnerability.

Successful exploitation can result in complete compromise of Oracle Project Portfolio Analysis, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive project portfolio data and operations.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or provide specific remediation instructions for this vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches promptly once available. Until a patch is applied, consider restricting network access to Oracle Project Portfolio Analysis instances and monitor for unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.