Oracle Cost Management CVE-2026-101536

Exploitation requires (1) a valid low-privileged, authenticated Oracle E-Business Suite account with network HTTP access to the Cost Maintenance component of Oracle Cost Management, and (2) affected EBS versions 12.2.3 through 12.2.15. Oracle rates it 'difficult to exploit' (AC:H), meaning success depends on specific conditions outside the attacker's direct control - likely particular application state, timing, or configuration - so it is NOT a trivially repeatable attack. Limiting factors that reduce realistic risk: mandatory prior authentication (PR:L rules out anonymous attackers), the high attack complexity, and the requirement that the Cost Management module be deployed and reachable. No end-user interaction is required (UI:N), and scope is unchanged (S:U), so impact is confined to the Cost Management module itself.

This is a genuine but not top-tier priority. Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable HTTP flaw that yields full takeover of Oracle Cost Management (C:H/I:H/A:H), which is serious, but two metrics meaningfully constrain real-world risk: AC:H (Oracle explicitly states it is 'difficult to exploit,' implying special timing, configuration, or state-dependent conditions) and PR:L (the attacker must already hold a low-privileged, authenticated EBS account). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation. SSVC-style reading: exploitation=none observed, automatable=likely NO given AC:H and the authentication requirement, technical impact=total for the affected module. Signals are internally consistent (no CVSS-vs-description conflict), but note the 'Information Disclosure' tag understates the actual impact, which is full confidentiality/integrity/availability takeover, not read-only disclosure. Net: a HIGH-severity, authenticated, hard-to-exploit ERP module flaw worth patching in the normal Oracle CPU cycle rather than emergency out-of-band response, absent new exploitation intelligence.

An attacker who already possesses a low-privileged Oracle E-Business Suite account (e.g., an internal user or a foothold from phishing/credential reuse) sends crafted HTTP requests to the Cost Maintenance component of Oracle Cost Management. By satisfying the specific state or timing conditions implied by the high attack complexity, they escalate from limited access to full compromise of the Cost Management module. No public exploit code is identified at time of analysis, and the AC:H rating means a reliable attack is non-trivial to develop.