SB20261107153 - Multiple vulnerabilities in Oracle Project Portfolio Analysis

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261107153

SB20261107153 - Multiple vulnerabilities in Oracle Project Portfolio Analysis

Published: November 7, 2026

Security Bulletin ID SB20261107153
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-60987)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


2) Improper input validation (CVE-ID: CVE-2026-60985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to modify data and cause limited service disruption.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to modify data and cause limited service disruption.


3) Improper input validation (CVE-ID: CVE-2026-60984)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


4) Improper input validation (CVE-ID: CVE-2026-60988)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


5) Improper input validation (CVE-ID: CVE-2026-60986)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


Remediation

Install update from vendor's website.

References