What is the CVSS score of CVE-2026-46941?

CVE-2026-46941 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Cost Management are affected by CVE-2026-46941?

Oracle Cost Management within Oracle E-Business Suite (CVE-2026-46941) is vulnerable to complete system compromise by any authenticated user, directly threatening the confidentiality, integrity, and…

How to fix or mitigate CVE-2026-46941?

Within 24 hours: inventory all Oracle EBS Cost Management deployments, restrict external and untrusted network access to this component, and enable comprehensive audit logging for authentication and administrative actions. Within 7 days: segment the Cost Management system from the broader network, restrict database connections to validated application sources only, and implement intrusion detection signatures specific to CVE-2026-46941 exploitation attempts. Within 30 days: continuously monitor Oracle's Critical Patch Update advisories for an available fix, establish a testing and validation plan for patching, conduct a complete audit log review for any suspicious low-privileged account activity or configuration changes, and verify that access controls remain restricted to documented business users only.

Oracle Cost Management CVE-2026-46941

EUVD-2026-46463 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-2q28-pf55-264j

Authentication Bypass Oracle Oracle Cost Management Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachable but requires an authenticated low-privilege EBS account (PR:L) and hard-to-meet preconditions (AC:H); takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:11 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Cost Management is a costing and inventory-valuation module of the Oracle E-Business Suite (EBS) applications stack, typically fronted by Oracle HTTP Server / Oracle Application Server and served over HTTP. The affected Cost Maintenance component is reached through the EBS web tier, meaning an authenticated EBS user with even minimal application privileges can send crafted HTTP requests to the module. No CWE was assigned (CWE: N/A) by Oracle, so the precise root-cause class (e.g., injection, broken access control, or deserialization) cannot be confirmed from the provided data; the 'takeover' outcome combined with the Information Disclosure tag suggests a flaw that escalates a low-privilege session into full control of the module's data and functions.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which is the vendor-released fix, following the patch matrix in https://www.oracle.com/security-alerts/cpujul2026.html for your EBS 12.2.x release level (an exact standalone fix version is not enumerated in the provided data beyond the CPU bundle, so patch is available per vendor advisory). Because exploitation requires an authenticated low-privilege EBS session over HTTP, interim compensating controls while patching include restricting network access to the EBS web tier and the Cost Management / Cost Maintenance URLs to trusted internal segments or VPN, tightening EBS user provisioning and removing unnecessary low-privilege application accounts, and enabling web-tier logging or WAF monitoring on Cost Management endpoints to detect anomalous requests; note that URL-level restrictions may disrupt legitimate costing users and should be scoped to the affected function pages. These workarounds are not a permanent substitute for the CPU patch.