CVE-2026-60987: Oracle Project Portfolio Auth Bypass Flaw

CVE-2026-60987 Overview

CVE-2026-60987 is a high-severity vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite, specifically in the Internal Operations component. Affected versions span 12.2.3 through 12.2.15. The flaw is easily exploitable over the network via HTTP and requires only low privileges with no user interaction. A successful attack allows unauthorized creation, deletion, or modification of critical data across all Oracle Project Portfolio Analysis accessible data, plus unauthorized read access to a subset of that data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers with network access can modify or destroy critical Project Portfolio Analysis data and read a subset of protected records without user interaction.

Affected Products

Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.3
Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Portfolio Analysis 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60987 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60987

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Project Portfolio Analysis, part of Oracle E-Business Suite. An attacker with a valid low-privileged application account can reach the vulnerable functionality over HTTP without any user interaction. Exploitation grants write-level access sufficient to create, alter, or delete records across the full set of Project Portfolio Analysis data, alongside limited read access to protected records.

Because Project Portfolio Analysis stores portfolio, project, and financial planning data used for executive decision-making, unauthorized modification can corrupt investment analysis, misallocate resources, or destroy audit trails. The integrity impact is rated High while confidentiality impact is Low, indicating the flaw is primarily a data tampering issue rather than a bulk data exfiltration issue.

Root Cause

Oracle has not published a technical root-cause description. Based on the advisory language and impact profile — full integrity compromise reachable by any authenticated low-privileged user — the flaw is consistent with a missing authorization check or broken access control in an Internal Operations HTTP endpoint. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is network-based over HTTP against the E-Business Suite web tier. The attacker must already hold valid low-privileged credentials to the EBS environment. No social engineering or user interaction is required. Once authenticated, the attacker issues crafted HTTP requests to the vulnerable Internal Operations functionality to trigger unauthorized data operations against Project Portfolio Analysis records.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.225% (percentile 13.27) as of 2026-07-23, indicating low predicted near-term exploitation likelihood.

Detection Methods for CVE-2026-60987

Indicators of Compromise

Unexpected create, update, or delete operations in Project Portfolio Analysis tables performed by low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user accounts that do not normally interact with portfolio data.
Gaps or anomalies in EBS audit trails covering portfolio, investment, or scenario records.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for Project Portfolio Analysis responsibilities.
Correlate database-level auditing on Project Portfolio Analysis schema tables with the responsibility and user identity performing changes.
Alert on any modification of portfolio, project, or investment records by users lacking a Project Portfolio Analysis responsibility assignment.

Monitoring Recommendations

Forward EBS application, middle-tier, and database audit logs to a centralized SIEM for correlation across HTTP, session, and SQL events.
Baseline typical Internal Operations HTTP request patterns and flag deviations by user, source IP, and request volume.
Monitor for privilege changes and new responsibility assignments granting Project Portfolio Analysis access.

How to Mitigate CVE-2026-60987

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite Project Portfolio Analysis as soon as change control allows.
Inventory EBS instances running versions 12.2.3 through 12.2.15 and prioritize internet-exposed environments for patching.
Review and reduce the population of accounts holding any Project Portfolio Analysis responsibility to the minimum required.
Rotate credentials for any low-privileged EBS accounts that may have been shared or exposed.

Patch Information

Oracle addressed CVE-2026-60987 in the July 2026 Critical Patch Update. Patch details, download links, and applicability matrices are published in the Oracle Critical Patch Update Advisory - July 2026. Customers on affected 12.2.x releases must apply the corresponding Project Portfolio Analysis patch bundle for their release level.

Workarounds

Restrict network access to the E-Business Suite web tier so that only trusted internal networks and VPN users can reach Internal Operations endpoints.
Temporarily unassign Project Portfolio Analysis responsibilities from users who do not actively require them until patches are deployed.
Enable enhanced database auditing on Project Portfolio Analysis schema objects to shorten detection time if exploitation is attempted.

bash

# Example: enable fine-grained auditing on a Project Portfolio Analysis table
# Replace SCHEMA.TABLE with the actual object identified in your environment
sqlplus / as sysdba <<EOF
BEGIN
  DBMS_FGA.ADD_POLICY(
    object_schema   => 'SCHEMA',
    object_name     => 'TABLE',
    policy_name     => 'PPA_CVE_2026_60987_MON',
    statement_types => 'INSERT,UPDATE,DELETE,SELECT'
  );
END;
/
EOF