EUVD-2026-47116
GHSA-35hw-92c2-q2h4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Network HTTP access required (AV:N); PR:H reflects mandatory high-privilege credentials per description; AC:H reflects Oracle's explicit 'difficult to exploit' characterization; partial DoS maps to A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cost Management. CVSS 3.1 Base Score 6.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L).
AnalysisAI
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Oracle Cost Management is a module within Oracle E-Business Suite (EBS), an enterprise ERP platform used for financial planning, supply chain, and manufacturing cost control. The vulnerable component is Cost Planning, which manages manufacturing cost structures, item costs, and cost rollups, typically exposed through the EBS web application stack over HTTP. No CWE identifier is provided in the available data, so the root cause class cannot be formally categorized; however, the 'Authentication Bypass' tag in the threat intelligence metadata hints at a potential access-control or authorization validation flaw within the Cost Planning workflow. The CVSS vector AV:N/AC:H/PR:H/UI:N/S:U indicates a network-reachable flaw requiring high application-level privileges and non-trivial attack conditions, but no client-side interaction. The absence of a CWE and the 'Authentication Bypass' tag together suggest the flaw may reside in server-side authorization logic rather than a memory-safety or injection class issue.
RemediationAI
Apply the patch provided by Oracle in the Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version within the 12.2.x line is not independently confirmed in the available data and must be identified from the CPU advisory for your specific EBS installation. As compensating controls while patching is in progress: restrict HTTP access to the Cost Planning component to a trusted internal network segment, reducing exposure to externally-connected or less-trusted hosts - note this does not protect against insider threats already holding high-level EBS credentials. Additionally, audit and minimize the set of users assigned high-privileged roles within Oracle Cost Management, as PR:H exploitation requires those elevated credentials. These controls reduce the attack surface but do not remediate the underlying vulnerability.
More in Cost Management
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 a
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Inter
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highl
Same weakness CWE-284 – Improper Access Control
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today