CVE-2026-61090

Analyzed Analyzed - Analysis Complete

Oracle Project Foundation Privilege Escalation

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Project Foundation executes to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Project Foundation. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61090

EUVD

EUVD-2026-47301

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	e-business_suite	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Project Foundation, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The issue allows a low-privileged attacker with system access to take over the Oracle Project Foundation component. The vulnerability has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle Project Foundation versions 12.2.3 to 12.2.15. Review system logs for unauthorized access attempts or privilege escalation events. Oracle's Critical Patch Update advisories may provide detection queries.

Impact Analysis

An attacker could exploit this to gain full control over Oracle Project Foundation, potentially leading to unauthorized data access, modification, or system disruption. Since it requires local access, internal threats or compromised systems are primary risks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected versions may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite, specifically addressing the Oracle Project Foundation component. Ensure all affected versions (12.2.3-12.2.15) are updated to the patched release. Restrict user privileges to the minimum required for operations.

Hi! I’m here to help you understand CVE-2026-61090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70