CVE-2026-61090: Oracle Project Foundation Privilege Escalation

CVE-2026-61090 Overview

CVE-2026-61090 is a local privilege escalation vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite, within the Miscellaneous component. Oracle disclosed the flaw in its July 2026 Critical Patch Update. Affected releases span versions 12.2.3 through 12.2.15.

A low-privileged attacker with logon access to the infrastructure where Oracle Project Foundation executes can compromise the product. Successful exploitation results in complete takeover of Oracle Project Foundation, with high impact to confidentiality, integrity, and availability.

Critical Impact
An authenticated local attacker with minimal privileges can fully take over Oracle Project Foundation, exposing project financials, contracts, and configuration data.

Affected Products

Oracle E-Business Suite — Oracle Project Foundation 12.2.3
Oracle E-Business Suite — Oracle Project Foundation versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Foundation 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61090 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61090

Vulnerability Analysis

CVE-2026-61090 affects the Miscellaneous component of Oracle Project Foundation, part of the Oracle E-Business Suite. Oracle characterizes the flaw as easily exploitable by an attacker who already holds low-privileged credentials on the infrastructure where the application runs.

Successful exploitation compromises confidentiality, integrity, and availability of the Project Foundation module. Because Project Foundation stores project accounting, contract, and resource data used across Oracle Financials and Projects modules, a full takeover can cascade across dependent business processes.

The advisory does not publish a specific CWE classification. The attack surface is local rather than network-facing, so exploitation requires prior access to the host or an interactive session, not remote reachability.

Root Cause

Oracle has not published the underlying weakness or a code-level description in the public advisory. The July 2026 Critical Patch Update entry describes the defect only at the component level. Refer to the Oracle Security Alert July 2026 for authoritative remediation metadata.

Attack Vector

The attack vector is local. An attacker must authenticate to the infrastructure hosting Oracle Project Foundation with low privileges, such as a standard operating system or application account. No user interaction is required, and the scope is unchanged, meaning impact remains within the vulnerable component's security authority. The EPSS probability of 0.151% reflects a low current likelihood of observed exploitation attempts.

No public proof-of-concept exploit code is available for CVE-2026-61090 at the time of publication. The vulnerability is described in prose only; consult Oracle's advisory for patch-level detail.

Detection Methods for CVE-2026-61090

Indicators of Compromise

Unexpected process execution or file writes by low-privileged accounts under the Oracle E-Business Suite installation directory, typically $APPL_TOP and the concurrent manager working directories.
New or modified Oracle Project Foundation concurrent programs, request definitions, or PL/SQL package bodies not tied to a change ticket.
Anomalous privilege changes on the APPS schema or Project Foundation responsibilities following interactive logons.

Detection Strategies

Baseline the users and processes that normally invoke Project Foundation concurrent programs, then alert on deviations.
Correlate operating system logons on the application tier with subsequent Oracle E-Business Suite session activity to spot lateral movement into Project Foundation.
Monitor the Oracle E-Business Suite audit tables (FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, FND_LOG_MESSAGES) for unusual patterns after local account access.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and host audit logs to a centralized analytics platform for retention and correlation.
Track version and patch level of Project Foundation across environments to confirm remediation coverage.
Enable file integrity monitoring on the $FND_TOP, $PA_TOP, and custom top directories to detect unauthorized binary or script changes.

How to Mitigate CVE-2026-61090

Immediate Actions Required

Apply the July 2026 Critical Patch Update for Oracle E-Business Suite to all Project Foundation deployments running versions 12.2.3 through 12.2.15.
Inventory local operating system and application accounts on Oracle E-Business Suite application tier hosts and remove or disable unused accounts.
Restrict interactive logon on application tier servers to a minimal set of administrators using host-level access controls.

Patch Information

Oracle addressed CVE-2026-61090 in the July 2026 Critical Patch Update. Customers should review the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and post-installation steps specific to Oracle Project Foundation 12.2.x.

Workarounds

Oracle does not publish a supported workaround; patching is the required remediation path.
As a compensating control, enforce least privilege on application tier hosts and require multi-factor authentication for administrative logons.
Isolate the Oracle E-Business Suite application tier on a dedicated network segment and restrict shell access to jump hosts with session recording.

bash

# Verify installed Project Foundation patch level after CPU July 2026 application
sqlplus -s apps/<password> <<EOF
SET PAGESIZE 200 LINESIZE 200
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT
EOF