Oracle Cost Management CVE-2026-62540

Exploitation requires possession of high-privileged credentials within Oracle E-Business Suite, confirmed by the CVSS PR:H metric - unauthenticated users and low-privileged users cannot exploit this vulnerability. Network access to the Oracle Cost Management HTTP interface is also required (AV:N). No specific non-default configuration or feature flag is described as a prerequisite; any deployment running affected versions 12.2.3-12.2.15 with the Cost Planning component accessible is in scope. The primary limiting factors are the PR:H credential requirement (restricting exploitation to insiders or post-compromise actors) and the need for HTTP network reachability to the EBS application tier.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a serious but meaningfully constrained vulnerability. The PR:H prerequisite is the critical limiting factor: exploitation requires an attacker to already hold high-privileged credentials within Oracle EBS, which significantly narrows the realistic attacker population to malicious insiders or actors who have separately compromised an administrator account. Oracle's 'easily exploitable' language describes attack complexity after credential acquisition, not the overall exploitation difficulty. No EPSS score was provided, so probability-of-exploitation data cannot be incorporated; this is a gap in the available intelligence. No KEV listing exists, and no POC code has been identified, indicating no confirmed or widespread exploitation at time of analysis. Organizations running Oracle EBS in internet-accessible configurations with shared or weakly managed admin credentials should treat this as higher priority than the CVSS score alone implies; those with strict privileged access management and network-segmented EBS deployments face substantially lower realistic risk.

An attacker holding high-privileged Oracle EBS credentials - obtained through insider access, phishing, or credential theft - sends a crafted HTTP request to the Cost Planning component of an affected Oracle Cost Management instance (12.2.3-12.2.15). Due to low attack complexity, no further exploitation prerequisites are required, and successful execution results in full takeover of the Oracle Cost Management module including access to all cost and planning data.