CVE-2026-46961: Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An unspecified vulnerability in the Internal Operations component of Oracle Project Portfolio Analysis (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker to reach the product over HTTP and exploit it without any special conditions. The attacker needs only a valid low-privilege account and network access to the service. Successful exploitation results in full takeover of the affected instance, with complete loss of confidentiality, integrity, and availability. HarborGuard is tracking this advisory as no fix version has been published yet, and will make a patched rebuild available the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Project Portfolio Analysis service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privilege account on the target system is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can exploit this vulnerability without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions, memory-layout dependencies, or other environmental prerequisites.

Blast Radius

• A successful attacker reads all data stored in the Oracle Project Portfolio Analysis instance, including project financials, resource allocations, and any credentials or session tokens held by the application.
• The attacker can modify or delete persisted project records, budgets, and operational data, corrupting the integrity of portfolio reporting.
• The attacker can crash or render the Oracle Project Portfolio Analysis service fully unavailable, disrupting project management and reporting workflows.
• Because the CVSS descriptor references full application takeover, the attacker gains effective control over the Internal Operations component and can pivot to interact with other integrated E-Business Suite modules.