Main Vulnerability Database Vulnerabilities #VU160186

Improper input validation in Oracle E-Business Suite and Oracle Project Portfolio Analysis - CVE-2026-60985

Published: November 7, 2026

Vulnerability identifier: #VU160186

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-60985

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to modify data and cause limited service disruption.

The vulnerability exists due to improper input validation within the Internal Operations component in Oracle Project Portfolio Analysis in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to modify data and cause limited service disruption.

Affected software

Oracle E-Business Suite
Oracle Project Portfolio Analysis

How to mitigate CVE-2026-60985

Install updates from vendor's website.

External References

https://www.oracle.com/security-alerts/cpujul2026.html

Related Security Bulletins