Oracle Cost Management CVE-2026-46940

Attacker must hold valid credentials for any Oracle E-Business Suite application user account (PR:L) and must be able to reach the EBS web tier - specifically the Oracle Cost Management module's Cost Planning component - over HTTP/HTTPS. Affected deployments are EBS 12.2.3 through 12.2.15 running the Cost Management product; environments where Cost Management is not licensed/installed, or where the EBS application URL is not reachable from the attacker's network position, are not exploitable. No user interaction is required (UI:N) and attack complexity is low (AC:L), but unauthenticated internet exploitation is NOT possible because PR:L is explicit in Oracle's published vector.

This is a genuine priority for organizations running EBS 12.2 internally, but not an unauthenticated internet emergency. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network exploitability with low complexity and no user interaction, and Oracle itself describes it as 'easily exploitable' resulting in 'takeover' - those are strong signals. However, PR:L means the attacker must already hold a valid EBS application account, which substantially narrows the threat compared with PR:N flaws; this is closer to a privilege-escalation/lateral-movement risk than a perimeter risk. No KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the input, so real-world exploitation probability cannot be quantified from the data given. The realistic concern is post-phishing or insider abuse: any low-rights EBS user (including service accounts, contractors, or compromised employee SSO sessions) can fully compromise the Cost Management module and the financial data it holds.

A contractor with a basic EBS application account, or an attacker who phished an entry-level employee's SSO credentials, logs into the EBS web tier and issues a crafted HTTP request against a Cost Planning page or servlet that fails to enforce proper authorization, allowing them to manipulate cost data, exfiltrate sensitive financial information, or pivot to full Cost Management takeover. No user interaction by a second party is required and no public exploit identified at time of analysis, but the AC:L/UI:N profile means a working request would be highly reliable once developed.