Oracle Cost Management CVE-2026-60806

Exploitation requires (1) network HTTP access to the Oracle E-Business Suite web tier hosting Cost Management, and (2) a valid low-privileged EBS account (CVSS PR:L - authenticated). What LIMITS exploitation: the vulnerability is high attack complexity (AC:H), meaning the attacker must meet additional conditions outside their control - such as winning a timing/race window or gathering specific environment-dependent information - before the attack succeeds; no user interaction is needed (UI:N). It is confined to supported EBS versions 12.2.3-12.2.15, and scope is unchanged (S:U), so impact stays within the Cost Management module rather than pivoting to other systems. This is NOT unauthenticated or default-config exploitable: both a login and the difficult preconditions must be met.

The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 (High) and blends opposing signals: network reachability with full CIA impact (raising severity) against high attack complexity plus a required authenticated account (lowering practical exploitability). AC:H means the attacker must win a race, defeat a mitigating condition, or gather specific preparatory information, and PR:L means a valid low-privilege EBS account is needed, so this is not a trivial internet-wide mass-exploitation candidate. No EPSS score, POC, or KEV status was provided, so exploitation probability cannot be quantified; the absence of KEV and any exploit reference suggests no known active exploitation. Net: an important patch for organizations running EBS 12.2.x (full module takeover), but the AC:H + PR:L combination makes opportunistic exploitation less likely than the 7.5 headline implies - prioritize by EBS exposure and account hygiene rather than treating it as a drop-everything unauthenticated RCE.

An attacker holding a low-privileged Oracle E-Business Suite account (for example a compromised employee or contractor login) sends crafted HTTP requests to the Cost Management Costing Transaction Errors component. By satisfying the specific complex conditions the flaw requires, they escalate from limited access to full takeover of the module, reading and altering costing data. No public exploit code has been identified, so this would currently require original exploit development.