Oracle Cost Management CVE-2026-60165

Exploitation requires network access to the Oracle Cost Management Enterprise Command Center component via HTTP, and the CVSS vector specifies a high-privilege attacker (PR:H), meaning valid administrative credentials to Oracle EBS are nominally required. The affected deployment must be running Oracle Cost Management V16. A critical ambiguity exists: the 'Authentication Bypass' tag associated with this CVE suggests the vulnerability may allow bypassing normal authentication or authorization controls, potentially negating the PR:H prerequisite in practice. If taken at face value, the CVSS conditions limit exploitation to authenticated administrators - a meaningful constraint in environments with tight account hygiene. No specific non-default configuration flag or feature toggle is identified as a prerequisite beyond running the affected version. Exploitation is limited to Oracle Cost Management V16; other EBS modules are not confirmed affected.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a network-exploitable vulnerability requiring high privileges, with no availability impact and no scope change. The combination of low attack complexity and high privilege requirement is notable: once an attacker has administrative credentials, exploitation is straightforward. However, the 'Authentication Bypass' tag from ENISA and the reporter's own tagging system introduces a significant conflict - if this vulnerability actually enables bypassing authentication, the effective privilege requirement may be PR:N rather than PR:H, dramatically increasing real-world risk. No EPSS score was provided in the input data. No KEV listing and no public POC means this is not confirmed actively exploited, keeping urgency moderate. For organizations running Oracle EBS with this module exposed to internal networks or internet-facing segments, the integrity and confidentiality impacts (C:H/I:H) are material. The absence of an availability impact (A:N) limits operational disruption risk. Overall: medium-priority patching for organizations running Oracle Cost Management V16, with elevated urgency if the Authentication Bypass tag reflects an actual PR:N exploitability condition - which cannot be confirmed from available data alone.

An attacker with administrative credentials to Oracle E-Business Suite navigates to the Enterprise Command Center component over HTTP and sends crafted requests that exploit a likely authorization control flaw, gaining unauthorized read access to all Cost Management data records and the ability to create, modify, or delete critical financial or manufacturing cost data. If the 'Authentication Bypass' tag reflects the true nature of the flaw, a lower-privileged or unauthenticated attacker on the same network could achieve the same outcome without valid high-privilege credentials. No public proof-of-concept code exists at time of analysis.