CVE-2026-60986: Oracle Project Portfolio Auth Bypass Flaw

CVE-2026-60986 Overview

CVE-2026-60986 is a high-severity vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access over HTTP to compromise Oracle Project Portfolio Analysis. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and full read access to all Oracle Project Portfolio Analysis accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated network-based attacker can read, modify, or delete all data accessible to Oracle Project Portfolio Analysis, impacting confidentiality and integrity of enterprise project data.

Affected Products

Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.3
Oracle E-Business Suite — Oracle Project Portfolio Analysis versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60986 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-60986

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Project Portfolio Analysis, part of the broader Oracle E-Business Suite. An attacker requires only low-level authenticated access and can reach the component over HTTP without user interaction. The impact scope is limited to the vulnerable component itself, but within that scope both confidentiality and integrity are fully compromised. Availability is not affected. The Exploit Prediction Scoring System (EPSS) currently places the near-term exploitation probability at 0.365%.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-60986. Based on the advisory language, the flaw permits an authenticated user to bypass expected access controls in the Internal Operations component, granting read and write access to data that should be restricted. Insufficient authorization enforcement on HTTP-exposed functionality is consistent with this class of Oracle E-Business Suite defect.

Attack Vector

The attacker interacts with the Oracle Project Portfolio Analysis application over the network via HTTP using valid low-privileged credentials. No user interaction is required, and the attack complexity is low. Once authenticated, the attacker sends crafted requests to Internal Operations endpoints to read, create, modify, or delete records accessible to the product. No verified public exploit is available at this time.

See the Oracle Critical Patch Update Advisory - July 2026 for vendor technical detail.

Detection Methods for CVE-2026-60986

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Oracle Project Portfolio Analysis Internal Operations URLs.
Unauthorized creation, modification, or deletion events in Project Portfolio Analysis audit tables that do not correlate with legitimate business workflows.
Anomalous outbound data volumes from Oracle E-Business Suite application tiers following authenticated user sessions.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify low-privileged accounts accessing Internal Operations functionality.
Correlate application server access logs with database DML activity on Project Portfolio Analysis schemas to spot privilege mismatches.
Hunt for repeated HTTP requests to Project Portfolio Analysis servlets or JSPs originating from accounts without a business role in project analysis.

Monitoring Recommendations

Forward Oracle E-Business Suite application, Apache/OHS access, and database audit logs into a centralized analytics platform for correlation.
Alert on privilege-role mismatches where users perform create, update, or delete actions on Project Portfolio Analysis data outside their assigned responsibilities.
Baseline normal request rates per user for Internal Operations endpoints and alert on statistical deviations.

How to Mitigate CVE-2026-60986

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite to all instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite environments, including non-production, to ensure comprehensive patch coverage.
Review and reduce access privileges on Oracle Project Portfolio Analysis responsibilities to enforce least privilege.
Rotate credentials for any accounts suspected of interacting with the Internal Operations component outside normal duties.

Patch Information

Oracle released the fix for CVE-2026-60986 as part of the Oracle Critical Patch Update - July 2026. Administrators should apply the corresponding Oracle E-Business Suite patch for versions 12.2.3 through 12.2.15. Oracle strongly recommends applying Critical Patch Update fixes without delay, as Oracle does not typically publish workarounds for E-Business Suite vulnerabilities.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints so only trusted internal networks and VPN clients can reach the application tier.
Temporarily remove Project Portfolio Analysis responsibilities from users who do not require them until patching is complete.
Place a web application firewall in front of the Oracle E-Business Suite application tier to log and constrain requests to Internal Operations URIs.

bash

# Example: verify installed Oracle E-Business Suite patch level
# Run from the APPL_TOP as the applmgr user
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop -status
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<JUL2026_CPU_BUG_NUMBER>');
EOF