CVE-2026-60901: Oracle Project Intelligence Escalation Flaw

CVE-2026-60901 Overview

CVE-2026-60901 affects the Oracle Project Intelligence product within Oracle E-Business Suite, specifically the Internal Operations component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this issue with minimal effort. Successful exploitation results in full takeover of Oracle Project Intelligence, compromising confidentiality, integrity, and availability.

Critical Impact
A low-privileged, authenticated attacker with HTTP access can achieve complete takeover of Oracle Project Intelligence, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Oracle E-Business Suite — Oracle Project Intelligence 12.2.3
Oracle E-Business Suite — Oracle Project Intelligence 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Intelligence 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60901 published to NVD
2026-07-21 - Last updated in NVD database
Oracle addressed this issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60901

Vulnerability Analysis

CVE-2026-60901 resides in the Internal Operations component of Oracle Project Intelligence, part of Oracle E-Business Suite. The flaw is reachable over HTTP and requires only low-level authenticated privileges. Oracle characterizes exploitation as easy, with no user interaction required and no elevated privileges needed to compromise the target.

The scope remains unchanged, meaning exploitation stays confined to the vulnerable Oracle Project Intelligence component. However, within that boundary the impact is comprehensive: attackers gain read access to sensitive data, can modify records, and can disrupt availability of the service. Oracle describes the outcome as complete takeover of Oracle Project Intelligence.

The EPSS score of 0.479% (38th percentile) indicates limited public exploitation activity at the time of publication, but the low attack complexity and network reach warrant prompt remediation.

Root Cause

Oracle has not publicly disclosed the underlying weakness class or a CWE mapping for CVE-2026-60901. Based on the CVSS metrics, the flaw is remotely reachable through the HTTP interface of the Internal Operations component and requires only a low-privileged account. Oracle E-Business Suite advisories typically withhold technical specifics to slow reverse engineering of the corresponding patch.

Attack Vector

The attacker authenticates with a low-privileged account and sends crafted HTTP requests to the Oracle Project Intelligence Internal Operations component. No user interaction is required, and attack complexity is low. Successful exploitation grants full control of the Project Intelligence module and its data.

No verified public proof-of-concept code exists for CVE-2026-60901. Refer to the Oracle Security Alert July 2026 for vendor-supplied remediation details.

Detection Methods for CVE-2026-60901

Indicators of Compromise

Unexpected HTTP requests to Oracle Project Intelligence Internal Operations endpoints originating from low-privileged user sessions.
New or modified Project Intelligence records without corresponding change-management approvals.
Anomalous authentication events for E-Business Suite accounts followed by administrative actions in Project Intelligence.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking logs for the Project Intelligence responsibility.
Correlate web tier access logs against the list of authorized Project Intelligence users to identify privilege abuse.
Alert on HTTP requests that target Internal Operations pages outside normal business patterns or from unusual source addresses.

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and E-Business Suite audit logs to a centralized SIEM for correlation.
Baseline typical usage of the Project Intelligence module and alert on deviations in request volume or endpoint distribution.
Monitor database-level activity from the APPS schema for unexpected DML against Project Intelligence tables.

How to Mitigate CVE-2026-60901

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for E-Business Suite as soon as change windows permit.
Inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and prioritize internet-exposed instances.
Review and reduce the population of accounts holding Project Intelligence responsibilities to the minimum required.
Rotate credentials for any low-privileged accounts suspected of exposure prior to patching.

Patch Information

Oracle released fixes for CVE-2026-60901 as part of the Oracle Security Alert July 2026. Administrators should follow Oracle's Critical Patch Update advisory to identify the specific patch set required for their E-Business Suite 12.2.x release and apply it through standard adop patching procedures.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier using a reverse proxy or web application firewall until patches are applied.
Disable or limit access to the Project Intelligence responsibility for user accounts that do not require it.
Enforce multi-factor authentication on all E-Business Suite user accounts to raise the cost of credential misuse.

bash

# Example: apply Oracle E-Business Suite patch via adop
# Replace <PATCH_ID> with the patch number listed in the July 2026 CPU advisory
source $APPL_TOP/APPS<CONTEXT>.env
adop phase=prepare
adop phase=apply patches=<PATCH_ID> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup