PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46960 Oracle Corporation CVE debrief

A high-severity vulnerability was found in Oracle Project Portfolio Analysis, a component of Oracle E-Business Suite. The vulnerability, tracked as CVE-2026-46960, has a CVSS score of 7.2 and can be easily exploited by high-privileged attackers with network access via HTTP, potentially leading to a takeover of the affected system. The vulnerability affects versions 12.2.3-12.2.15 of Oracle Project Portfolio Analysis. The vulnerability has a high impact on confidentiality, integrity, and availability, and its exploitation requires high privileges and network access via HTTP.

Vendor
Oracle Corporation
Product
Oracle Project Portfolio Analysis
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using Oracle Project Portfolio Analysis versions 12.2.3-12.2.15 should prioritize patching this vulnerability. High-privileged attackers could exploit this vulnerability to gain unauthorized access and control over the affected system. The vulnerability's impact on confidentiality, integrity, and availability is high, and its exploitation requires high privileges and network access via HTTP.

Technical summary

The vulnerability is located in the Internal Operations component of Oracle Project Portfolio Analysis. It has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating a high impact on confidentiality, integrity, and availability. The vulnerability is easily exploitable and requires high privileges and network access via HTTP. The affected product is Oracle Project Portfolio Analysis, which is a part of Oracle E-Business Suite. The vulnerability's technical details are based on the CVE record and the NVD entry.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible
  • Restrict access to the affected system to only necessary personnel
  • Monitor the affected system for any suspicious activity
  • Consider implementing additional security controls, such as multi-factor authentication
  • Review and update access controls to prevent unauthorized access
  • Perform regular security audits to identify potential vulnerabilities
  • Implement a incident response plan in case of a security breach

Evidence notes

The CVE record was published on 2026-06-17T10:54:15.157Z and last modified on 2026-06-18T22:18:20.400Z. The NVD entry is currently Analyzed. The vulnerability is in Oracle Project Portfolio Analysis, a component of Oracle E-Business Suite, with a CVSS score of 7.2. The vulnerability has a high impact on confidentiality, integrity, and availability. The CVE record was obtained from the NVD database, which is a comprehensive vulnerability database maintained by the US National Institute of Standards and Technology (NIST). The information provided is based on the data available up to the last modification date.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T10:54:15.157Z and has not been modified since then. The NVD entry is currently Analyzed.