CVE-2026-60988: Oracle Project Portfolio Privilege Escalation

CVE-2026-60988 Overview

CVE-2026-60988 affects the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. The flaw resides in the Internal Operations component and impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can compromise the application, though exploitation is rated as difficult due to high attack complexity. Successful exploitation leads to complete takeover of Oracle Project Portfolio Analysis, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows a low-privileged network attacker to fully take over Oracle Project Portfolio Analysis, compromising confidentiality, integrity, and availability of the application.

Affected Products

Oracle E-Business Suite - Oracle Project Portfolio Analysis 12.2.3
Oracle E-Business Suite - Oracle Project Portfolio Analysis versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Project Portfolio Analysis 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60988 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Critical Patch Update

Technical Details for CVE-2026-60988

Vulnerability Analysis

CVE-2026-60988 is a vulnerability in the Internal Operations component of Oracle Project Portfolio Analysis, an Oracle E-Business Suite module used for evaluating and prioritizing project investments. The flaw is reachable over the network through HTTP and requires the attacker to hold a low-privileged account within the application. Despite the authentication requirement, successful exploitation results in a complete takeover of the Project Portfolio Analysis application, with high impact on confidentiality, integrity, and availability. Oracle classifies the exploitation difficulty as high, indicating that specific conditions outside the attacker's control must be met.

Root Cause

Oracle has not disclosed the technical root cause in the public advisory. The vulnerability class is not identified with a CWE identifier in the NVD record. Based on the impact profile and component context, the flaw permits an authenticated user to escalate control over the Project Portfolio Analysis module beyond their authorized scope through HTTP-facing functionality in the Internal Operations component.

Attack Vector

An attacker must possess valid low-privileged credentials on the target Oracle E-Business Suite instance. The attacker then issues crafted HTTP requests to the Project Portfolio Analysis Internal Operations endpoints. No user interaction is required. The scope remains unchanged, meaning the compromise is contained within the vulnerable component, but the entire Project Portfolio Analysis application falls under attacker control on success.

No public proof-of-concept or exploit code has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and Oracle has not reported in-the-wild exploitation. See the Oracle Critical Patch Update - July 2026 advisory for vendor-provided details.

Detection Methods for CVE-2026-60988

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite user sessions targeting Project Portfolio Analysis Internal Operations URLs.
Anomalous administrative actions, configuration changes, or data modifications within Project Portfolio Analysis performed by non-administrative accounts.
Unusual outbound connections or process launches originating from the Oracle E-Business Suite application tier.

Detection Strategies

Enable Oracle E-Business Suite application-level auditing for the Project Portfolio Analysis module and monitor for privilege-inconsistent activity.
Review web tier access logs for repeated or malformed HTTP requests targeting Internal Operations endpoints from a single authenticated session.
Correlate application-tier activity with database audit trails to identify unauthorized data reads or writes.

Monitoring Recommendations

Forward Oracle E-Business Suite application, web tier, and database audit logs to a centralized analytics platform for correlation.
Baseline normal usage patterns for Project Portfolio Analysis users and alert on deviations such as off-hours access or bulk operations.
Track EPSS trend data for CVE-2026-60988, currently at 0.37% with a 29.58 percentile, and reassess exposure if exploitation likelihood rises.

How to Mitigate CVE-2026-60988

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running Project Portfolio Analysis versions 12.2.3 through 12.2.15.
Inventory all E-Business Suite deployments and confirm the Project Portfolio Analysis module status, even where it is not actively used.
Review and reduce the number of accounts with access to the Project Portfolio Analysis application to enforce least privilege.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's patching procedures for E-Business Suite 12.2.x and apply all associated prerequisites. Refer to the Oracle Critical Patch Update Advisory - July 2026 for the specific patch identifiers and installation guidance.

Workarounds

Restrict network access to Oracle E-Business Suite web tiers using firewalls, VPNs, or reverse proxies so only trusted internal users can reach the application.
Disable or restrict access to the Project Portfolio Analysis responsibility for users who do not require it until patching is complete.
Enforce strong authentication and monitor low-privileged accounts closely, as exploitation requires valid credentials.

bash

# Verify installed Oracle E-Business Suite version and applied patches
# Consult Oracle documentation for exact commands in your environment
sqlplus apps/<password> <<EOF
SELECT release_name FROM fnd_product_groups;
SELECT bug_number, last_update_date FROM ad_bugs 
  WHERE bug_number IN ('<CPUJUL2026_BUG_IDS>');
EXIT;
EOF