Oracle Cost Management CVE-2026-60805

Exploitation requires: (1) network access to the Oracle EBS application layer via HTTP, and (2) high application-level privileges within Oracle Cost Management (PR:H - i.e., an account with administrative or cost management authority within EBS). Additionally, AC:H indicates that specific non-trivial conditions must be satisfied for the attack to succeed, such as a particular system state, race condition, or multi-step precondition sequence; the exact condition is not disclosed in Oracle's advisory summary. The 'Authentication Bypass' tag introduces an unresolved ambiguity - if the flaw itself enables bypassing authentication, the initial privilege prerequisite may be lower than PR:H implies, and this must be verified against the full CPU advisory. Limiting factors: attacker must hold or acquire high-level EBS credentials, the target system must be reachable over HTTP, and the attack's high complexity requirement must be independently satisfied. Organizations where EBS is accessible only from a restricted internal network, and where high-privileged Cost Management roles are tightly controlled, face materially lower risk.

Despite high confidentiality and integrity impacts (C:H/I:H), the real-world risk is substantially constrained by two key CVSS metrics: AC:H (high attack complexity, meaning non-trivial conditions must be met) and PR:H (attacker must already hold high-level Oracle EBS credentials). These barriers collectively reduce the actionable threat surface to insiders, compromised privileged accounts, or attackers who have already established a foothold and escalated privilege via a separate vulnerability. The overall CVSS 3.1 base score of 6.2 (Medium) accurately reflects this constrained exploitability. A notable tension exists in the available data: the 'Authentication Bypass' threat intelligence tag implies the vulnerability may itself reduce the effective authentication barrier - which would contradict the PR:H metric. This discrepancy is unresolved and must be clarified against the Oracle CPU July 2026 advisory before dismissing the vulnerability as low priority based on PR:H alone. No EPSS score is available, the vulnerability is absent from the CISA KEV catalog, and no proof-of-concept is publicly known, all of which further reduce the urgency of opportunistic exploitation. This vulnerability represents a prioritized patching item for organizations running Oracle EBS with the Cost Planning module internet-exposed or accessible to a broad internal user base.

A highly privileged Oracle EBS user - or an attacker who has obtained such credentials through phishing or lateral movement - accesses the Cost Planning component over HTTP and satisfies the high-complexity exploitation condition (such as a specific application state, timing dependency, or multi-step request sequence). Successful exploitation allows the attacker to read, exfiltrate, create, modify, or delete critical cost planning records across the Oracle Cost Management module, and may partially disrupt the service. No public proof-of-concept exists at time of analysis.