Vulnerability in Oracle Corporation Oracle Project Contracts

[ Description ]Official description

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4088

  Oracle E-Business Suite: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-60746CVE-2026-101840CVE-2026-101538+191 more CVEs

[ References ]References

• www.oracle.com/security-alerts/cpuoct2026.html