CVE-2026-46962: Oracle Project Portfolio Privilege Escalation

CVE-2026-46962 Overview

CVE-2026-46962 is a privilege management weakness [CWE-269] in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue to compromise Oracle Project Portfolio Analysis. Successful exploitation leads to a full takeover of the product, impacting confidentiality, integrity, and availability. Oracle disclosed the vulnerability in its June 2026 Critical Patch Update advisory.

Critical Impact
An authenticated attacker with low privileges can take over Oracle Project Portfolio Analysis remotely over HTTP without user interaction.

Affected Products

Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.3
Oracle E-Business Suite — Oracle Project Portfolio Analysis versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.15

Discovery Timeline

2026-06-17 - CVE-2026-46962 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46962

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Project Portfolio Analysis, a module of Oracle E-Business Suite. The weakness is classified under [CWE-269] Improper Privilege Management. An authenticated user holding only low-level application privileges can issue crafted HTTP requests that result in a complete compromise of the Project Portfolio Analysis application.

The attack does not require user interaction and executes within the scope of the vulnerable component. Because the underlying flaw impacts privilege boundaries, the attacker can read, modify, and destroy data managed by Project Portfolio Analysis. The CVSS 3.1 base score of 8.8 reflects high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is improper enforcement of privilege checks within the Internal Operations functionality. Authorization decisions appear to be made without sufficient validation of the requesting user's effective entitlements. As a result, operations intended for administrative or elevated roles become reachable from accounts that hold only basic application access.

Attack Vector

Exploitation occurs over the network through HTTP requests directed at exposed Oracle E-Business Suite endpoints. The attacker must authenticate with a valid low-privilege account but does not need administrative credentials. Once authenticated, the attacker issues crafted requests to the Internal Operations component to escalate access and execute privileged actions, leading to product takeover.

No verified public proof-of-concept code is available at this time. Refer to the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-46962

Indicators of Compromise

Unexpected HTTP POST or GET requests from low-privilege user sessions targeting Internal Operations endpoints in Oracle Project Portfolio Analysis.
Application audit log entries showing privileged actions executed by users without corresponding role assignments.
New, unexplained administrative records, workflow changes, or data exports originating from non-administrative accounts.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify access to Internal Operations functions by accounts that should not reach them.
Correlate web tier access logs with application user roles to flag mismatches between requested URLs and user entitlements.
Hunt for repeated 200-status responses to privileged endpoints from session IDs tied to low-privilege users.

Monitoring Recommendations

Forward Oracle E-Business Suite middle-tier and database audit logs to a centralized SIEM for behavioral baselining.
Alert on privilege escalation patterns, including role assignment changes and use of FND security APIs outside normal administrative windows.
Monitor outbound connections from the EBS application tier for signs of post-compromise data exfiltration.

How to Mitigate CVE-2026-46962

Immediate Actions Required

Apply the patches provided in the Oracle June 2026 Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Restrict network exposure of Oracle E-Business Suite to trusted networks and place the application behind a reverse proxy or WAF that enforces authentication.
Audit all Oracle E-Business Suite user accounts and remove or disable accounts that are inactive, shared, or over-privileged.

Patch Information

Oracle has released fixes as part of the June 2026 Critical Patch Update. Customers should download and apply the relevant patches for Oracle E-Business Suite 12.2.x as documented in the Oracle Security Alert. Validate patch deployment in a non-production environment before rolling out to production.

Workarounds

If immediate patching is not possible, limit HTTP access to the Project Portfolio Analysis module to a restricted set of administrative IP ranges.
Disable or restrict the Internal Operations functions for non-administrative responsibilities using Oracle E-Business Suite function security.
Increase audit logging for the affected responsibilities and review activity daily until patches are applied.

bash

# Configuration example: restrict HTTP access at the reverse proxy
# (Apache httpd in front of Oracle E-Business Suite)
<Location /OA_HTML/>
    Require ip 10.10.0.0/24 10.20.0.0/24
    AuthType Basic
    AuthName "EBS Restricted"
    Require valid-user
</Location>