Listen to this Post
CVE-2026-60985 is a vulnerability residing in the Internal Operations component of the Oracle Project Portfolio Analysis product, which is part of the broader Oracle E-Business Suite. This flaw affects versions 12.2.3 through 12.2.15 inclusive. The vulnerability is classified as easily exploitable, meaning an attacker does not need to overcome complex security mechanisms to leverage it. The attack vector is network-based, requiring only HTTP access to the target system. The attacker must possess low-privileged credentials, such as a basic user account within the E-Business Suite environment, but does not require any user interaction from the victim. The attack complexity is low, and no additional privileges are needed beyond the low-privileged access.
The core of the vulnerability lies in improper authorization checks within the Internal Operations module. This module handles various internal project management functions, including creation, modification, and deletion of project data. Due to insufficient validation of user permissions, a low-privileged attacker can send crafted HTTP requests to the affected endpoints, bypassing the intended access controls. Successful exploitation allows the attacker to perform unauthorized operations on critical data, including creating new records, deleting existing ones, or modifying sensitive project information. Furthermore, the attacker can induce a partial denial-of-service condition, disrupting the availability of the Project Portfolio Analysis service, though not completely crashing the system.
The CVSS v3.1 base score is 7.1, which is considered High severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. This indicates that while confidentiality is not impacted (C:N), integrity is highly impacted (I:H) and availability is partially impacted (A:L). The scope is unchanged (S:U). The vulnerability does not require user interaction and can be exploited remotely over the network. Given the ease of exploitation and the potential for data manipulation, this vulnerability poses a significant risk to organizations using the affected Oracle E-Business Suite versions.
The vulnerability was published on July 21, 2026, and subsequently updated on July 22, 2026. It has been assigned a CVSS v2 base score of 7.5, further underscoring its severity. The EPSS (Exploit Prediction Scoring System) score is 0.00269, indicating a relatively low probability of exploitation in the wild currently, but this does not diminish the need for urgent patching due to the critical nature of the data at risk.
DailyCVE Form:
Platform: Oracle E-Business Suite
Version: 12.2.3–12.2.15
Vulnerability: Authorization Bypass
Severity: High (7.1)
Date: 2026-07-21
Prediction: October 2026 CPU
What Undercode Say:
Analytics:
- CVSS v3.1 Score: 7.1 (High)
- CVSS v2 Score: 7.5 (High)
- EPSS: 0.00269 (Low probability)
- Affected Versions: 12.2.3 – 12.2.15
- Attack Vector: Network (HTTP)
- Privileges Required: Low
- User Interaction: None
- Integrity Impact: High
- Availability Impact: Partial
Bash Commands to check Oracle E-Business Suite version:
Check Oracle E-Business Suite version from the database sqlplus apps/apps_password <<EOF select RELEASE_NAME from FND_PRODUCT_GROUPS; EOF Check installed patches adop phase=prepare patches=show Query the version of Project Portfolio Analysis component sqlplus apps/apps_password <<EOF select PATCH_NAME, PATCH_TYPE, DESCRIPTION from AD_APPLIED_PATCHES where upper(DESCRIPTION) like '%PROJECT PORTFOLIO%'; EOF
Exploit:
Exploitation of CVE-2026-60985 involves an authenticated low-privileged attacker sending specially crafted HTTP requests to the Internal Operations endpoints of Oracle Project Portfolio Analysis. The attacker can manipulate parameters in the requests to bypass authorization controls. A proof-of-concept might involve:
– Intercepting a legitimate request to a project management function using a proxy like Burp Suite.
– Modifying the request parameters (e.g., changing project IDs or user roles) to perform actions beyond the attacker’s privileges.
– Replaying the request to create, delete, or modify project data.
– Sending a high volume of requests to trigger the partial denial-of-service condition.
Example of a crafted HTTP POST request:
POST /oracle/ppa/internal/updateProject HTTP/1.1 Host: target.oracle.com Cookie: JSESSIONID=... Content-Type: application/x-www-form-urlencoded projectId=12345&action=delete&userId=attacker
By altering the `projectId` and `action` parameters, the attacker can manipulate unauthorized projects.
Protection:
- Apply the Oracle Critical Patch Update (CPU) released in July 2026 (or the upcoming October 2026 CPU if the patch is not yet applied). The patch addresses the flawed authorization logic in the Internal Operations component.
- Restrict network access to the Oracle E-Business Suite application firewall or VPN, allowing only trusted IP ranges.
- Enforce the principle of least privilege: review and minimize user permissions within the E-Business Suite.
- Monitor logs for suspicious activities, such as unusual project modifications or deletion attempts from low-privileged accounts.
- Implement Web Application Firewall (WAF) rules to detect and block anomalous HTTP requests targeting the Project Portfolio Analysis endpoints.
Impact:
Successful exploitation of this vulnerability allows an attacker to:
– Unauthorized Data Manipulation: Create, delete, or modify critical project data within Oracle Project Portfolio Analysis, potentially leading to data corruption, loss of project integrity, and financial or operational disruptions.
– Partial Denial of Service: Cause a partial DoS condition, making the Project Portfolio Analysis service partially unavailable, which can hamper project management operations and reduce productivity.
– Compliance Violations: If the manipulated data includes sensitive or regulated information, the organization may face compliance breaches and regulatory penalties.
– Reputational Damage: Public disclosure of a security breach resulting from this vulnerability can erode customer trust and damage the organization’s reputation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
