CVE-2026-60984 Overview
CVE-2026-60984 affects the Oracle Project Portfolio Analysis product within Oracle E-Business Suite, specifically the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are impacted. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise Oracle Project Portfolio Analysis. Successful exploitation enables unauthorized creation, deletion, or modification of critical data across all accessible Project Portfolio Analysis data. Attackers also gain unauthorized read access to a subset of data. Oracle disclosed the issue in the July 2026 Critical Patch Update advisory.
Critical Impact
A low-privileged authenticated attacker can modify or destroy critical Oracle Project Portfolio Analysis data over the network without user interaction.
Affected Products
- Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.3
- Oracle E-Business Suite — Oracle Project Portfolio Analysis versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.15
Discovery Timeline
- 2026-07-21 - CVE-2026-60984 published to the National Vulnerability Database
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60984
Vulnerability Analysis
The vulnerability resides in the Internal Operations component of Oracle Project Portfolio Analysis, a module of Oracle E-Business Suite. An authenticated attacker with low privileges can send crafted HTTP requests to interact with functionality that lacks sufficient access control. The result is broad write access to Project Portfolio Analysis data and partial read exposure. Because exploitation requires only network reachability and a valid low-privilege account, insider misuse and post-compromise pivoting are practical attack scenarios. Oracle rates the confidentiality impact as low and the integrity impact as high, with no direct impact to availability. Attackers can leverage the integrity impact to falsify portfolio decisions, alter financial or operational planning data, or destroy records that downstream processes depend on.
Root Cause
Oracle has not published detailed root cause information in public references. The advisory characterizes the issue as an easily exploitable flaw in the Internal Operations component reachable over HTTP by an authenticated user. The CVSS vector indicates unchanged scope, suggesting the flaw affects resources managed by the vulnerable component rather than escaping into other Oracle E-Business Suite modules. The behavior is consistent with a broken access control weakness in application-layer request handlers.
Attack Vector
Exploitation is remote over HTTP. The attacker must hold a valid low-privileged account within Oracle E-Business Suite. No user interaction is required. Once authenticated, the attacker issues HTTP requests to Internal Operations endpoints of Project Portfolio Analysis to create, modify, or delete records. Full technical details are restricted to Oracle customers through the Oracle Critical Patch Update Advisory - July 2026.
Detection Methods for CVE-2026-60984
Indicators of Compromise
- Unexpected create, update, or delete operations against Project Portfolio Analysis tables performed by low-privileged application accounts.
- HTTP requests to Internal Operations endpoints originating from user sessions that do not normally interact with Project Portfolio Analysis workflows.
- Anomalous volumes of record modifications outside of scheduled batch windows.
Detection Strategies
- Review Oracle E-Business Suite audit trails (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for unusual access to Project Portfolio Analysis pages by non-portfolio users.
- Correlate web tier access logs with database DML activity to identify HTTP requests that produce disproportionate write operations.
- Baseline normal Project Portfolio Analysis usage per role and alert on deviations from that baseline.
Monitoring Recommendations
- Forward Oracle E-Business Suite application, database, and HTTP server logs to a centralized SIEM for cross-source correlation.
- Enable Oracle database Fine-Grained Auditing on Project Portfolio Analysis tables to record row-level changes with the initiating session identity.
- Alert on privilege changes, responsibility assignments, and role grants that expand access to Project Portfolio Analysis.
How to Mitigate CVE-2026-60984
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Project Portfolio Analysis.
- Inventory user accounts and responsibilities that grant access to Project Portfolio Analysis and remove access that is not required.
- Rotate credentials for any low-privileged accounts suspected of misuse and enforce multi-factor authentication where supported.
Patch Information
Oracle addressed CVE-2026-60984 in the Critical Patch Update released in July 2026. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, prerequisites, and application instructions for Oracle E-Business Suite 12.2.
Workarounds
- Restrict network access to Oracle E-Business Suite HTTP endpoints using a reverse proxy or web application firewall until patches are applied.
- Temporarily revoke the Project Portfolio Analysis responsibilities from users who do not require them.
- Increase audit logging on Project Portfolio Analysis functions to shorten identification time if exploitation is attempted before patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
