CVE-2026-46960: Oracle E-Business Suite Privilege Escalation

CVE-2026-46960 Overview

CVE-2026-46960 is a high-severity access control vulnerability affecting the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. The flaw resides in the Internal Operations component and impacts supported versions 12.2.3 through 12.2.15. An attacker with high privileges and network access via HTTP can exploit this vulnerability to compromise the affected product. Successful exploitation results in full takeover of Oracle Project Portfolio Analysis, with impact to confidentiality, integrity, and availability. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Successful exploitation results in complete takeover of Oracle Project Portfolio Analysis, compromising confidentiality, integrity, and availability of the product.

Affected Products

Oracle E-Business Suite — Oracle Project Portfolio Analysis, version 12.2.3
Oracle E-Business Suite — Oracle Project Portfolio Analysis, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Portfolio Analysis, version 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46960

Vulnerability Analysis

The vulnerability exists in the Internal Operations component of Oracle Project Portfolio Analysis, part of the Oracle E-Business Suite stack. It is classified as an Improper Access Control issue [CWE-284]. According to Oracle, the flaw is easily exploitable by an authenticated attacker holding high privileges within the application. Exploitation occurs over the network through standard HTTP requests, without requiring any user interaction.

The scope is unchanged, meaning the compromise is contained within the vulnerable component. However, all three security properties — confidentiality, integrity, and availability — are fully impacted. Oracle characterizes successful exploitation as a complete takeover of Oracle Project Portfolio Analysis. This places the flaw in a category where a trusted insider or a compromised privileged account can pivot from limited application access to full control of the module.

Root Cause

The root cause is improper access control within the Internal Operations component. Authorization checks do not adequately restrict the operations that a high-privileged authenticated user can perform, allowing actions that should be constrained by role boundaries. Oracle's June 2026 Critical Security Patch Update advisory documents the issue but does not disclose internal implementation details. See the Oracle Security Alert for vendor information.

Attack Vector

An attacker must already hold high-privileged credentials within Oracle Project Portfolio Analysis. From there, the attacker sends crafted HTTP requests to the affected Internal Operations interfaces over the network. Because attack complexity is low and no user interaction is required, exploitation is straightforward once privileges are obtained. Common abuse paths include credential theft, compromised administrator workstations, or insider misuse.

No public exploit code or proof-of-concept is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is 0.43% (percentile 34.27) as of 2026-06-18.

Detection Methods for CVE-2026-46960

Indicators of Compromise

Unusual HTTP requests to Oracle Project Portfolio Analysis Internal Operations endpoints originating from accounts that do not typically perform administrative actions.
Unexpected changes to portfolio configurations, scoring models, or financial planning data within Oracle Project Portfolio Analysis.
Authentication events from high-privileged Oracle E-Business Suite accounts at unusual hours or from unexpected source addresses.

Detection Strategies

Audit Oracle E-Business Suite application logs and FND_LOG_MESSAGES for privileged operations targeting the Project Portfolio Analysis module.
Correlate web-tier access logs with E-Business Suite session records to identify HTTP requests issued by high-privileged users to Internal Operations URLs.
Establish baselines for normal administrator activity in Project Portfolio Analysis and flag deviations in request volume, endpoints accessed, or data modified.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web-tier logs to a centralized SIEM for correlation and retention.
Monitor changes to highly privileged Oracle E-Business Suite responsibilities and role assignments such as System Administrator and Project Portfolio Analysis super user roles.
Alert on configuration export, mass-update, or bulk-delete operations within the Project Portfolio Analysis module.

How to Mitigate CVE-2026-46960

Immediate Actions Required

Apply the patches included in the Oracle Critical Patch Update referenced in the Oracle Security Alert to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Review and reduce the number of accounts assigned high-privileged Project Portfolio Analysis responsibilities to the minimum required.
Rotate credentials for privileged Oracle E-Business Suite accounts and enforce multi-factor authentication for administrative access.
Restrict network access to the Oracle E-Business Suite web tier so that only trusted management networks can reach administrative endpoints.

Patch Information

Oracle addressed CVE-2026-46960 in the June 2026 Critical Security Patch Update. Customers must apply the relevant Oracle E-Business Suite 12.2 patches to remediate the issue. Refer to the Oracle Security Alert for patch identifiers, prerequisites, and platform-specific guidance.

Workarounds

If immediate patching is not possible, temporarily revoke high-privileged Project Portfolio Analysis responsibilities from accounts that do not actively require them.
Place the Oracle E-Business Suite web tier behind a reverse proxy or web application firewall that restricts access to Internal Operations URLs by source IP and authenticated identity.
Increase audit verbosity on privileged Project Portfolio Analysis sessions and review activity daily until patches are deployed.

bash

# Configuration example: restrict access to Oracle E-Business Suite admin paths at the reverse proxy
# (Illustrative nginx snippet — adapt to your environment before use)
location ~* /OA_HTML/.*(InternalOperations|ppa).* {
    allow 10.10.20.0/24;   # trusted admin network
    deny  all;
    proxy_pass http://ebs_backend;
}