Oracle Project Costing CVE-2026-60340

Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the Enterprise Command Center component of Oracle Project Costing on a running EBS 12.2.3-12.2.15 instance. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the PR:H prerequisite is the key limiting factor: an unprivileged or anonymous user cannot exploit this, which confines realistic risk to insiders, compromised privileged accounts, or post-exploitation lateral movement. Deployment must include the Enterprise Command Center for Project Costing being provisioned and web-accessible.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows a network-reachable, low-complexity attack with no user interaction that yields full confidentiality, integrity, and availability impact - but critically requires PR:H, meaning the attacker must already hold high privileges in the EBS environment. That single factor is what keeps the score at High (7.2) rather than Critical: this is not an unauthenticated internet-facing takeover but a privilege-dependent compromise, most relevant as a post-authentication or insider/lateral-movement risk. No EPSS score, SSVC decision, or KEV entry was provided; there is no public exploit identified at time of analysis, so real-world exploitation pressure appears low today. Oracle's 'easily exploitable' language is consistent with AC:L but does not override the PR:H prerequisite. Net assessment: a genuine but conditional priority - high value where an attacker can obtain EBS privileges, lower urgency for organizations with tightly controlled EBS access, and it should be patched on the normal Oracle CPU cadence.

An attacker who has already obtained a high-privilege EBS account - for example a compromised administrator or a malicious insider with an elevated Project Costing responsibility - sends crafted HTTP requests to the Enterprise Command Center interface and escalates from those privileges to a full takeover of the Project Costing module, reading, altering, or destroying costing data. No user interaction is required and the attack complexity is low, but no public exploit code has been identified at time of analysis, so an attacker would need to develop the technique independently.