Oracle Cost Management CVE-2026-46929

Exploitation requires network reachability to the Oracle E-Business Suite application/HTTP tier hosting the Cost Management module and a valid low-privileged EBS user credential (PR:L); no user interaction, no admin role, and no scope change are required, and the targeted versions are EBS Cost Management 12.2.3 through 12.2.15. Exploitation is limited by the need for a working EBS login: deployments that do not expose EBS to the internet, that enforce strong authentication (MFA/SSO at the front door), and that restrict Cost Management responsibilities to a small set of finance users materially reduce the attacker population, while internet-exposed self-service or supplier-portal deployments where any registered user can reach the Cost Planning OA Framework endpoints are at highest realistic risk.

This is a genuine priority for any organization running EBS 12.2: CVSS 3.1 base 8.8 with AV:N/AC:L/PR:L/UI:N and full C/I/A impact means a single low-privileged EBS account - which many enterprises issue broadly to employees, contractors, and partners - can take over Cost Management. EPSS and CISA KEV are not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be asserted; however, Oracle EBS CPU vulnerabilities historically attract reverse-engineering once patches ship, and Oracle itself rates this 'easily exploitable.' The main mitigating factor is the PR:L requirement: a fully external unauthenticated attacker cannot directly exploit this unless EBS self-registration or stolen/guessable credentials are in play. No conflicting signals were identified in the supplied data, but the absence of CWE and a technical write-up means defenders must trust Oracle's qualitative 'takeover' wording without an independent root-cause analysis.

An attacker who has obtained or been issued any low-privileged Oracle E-Business Suite account - for example a self-service employee, supplier portal user, or a credential harvested via phishing - authenticates to the EBS web tier and sends crafted HTTP requests to the Cost Planning component, abusing the undisclosed flaw to escalate within Cost Management and read, modify, or destroy cost data and configurations. No user interaction or additional privileges are required and attack complexity is low, but no public exploit has been identified at time of analysis.