What is the CVSS score of EUVD-2026-37253?

EUVD-2026-37253 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-37253?

24 hours: Identify and audit all active high-privileged Cost Planning users; implement immediate network-level restrictions on HTTP access to the Cost Planning module; document current privilege assignments. 7 days: Contact Oracle support to confirm patch availability timeline and release date; evaluate temporary access restrictions for non-critical users. 30 days: Apply vendor patch immediately upon release; implement privileged access monitoring and enhanced audit logging for all Cost Planning transactions.

Oracle Cost Management EUVD-2026-37253

| CVE-2026-46938 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Cost Management Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain high-privileged EBS responsibility
Delivery

Authenticate to EBS web tier
Exploit

Send crafted HTTP request to Cost Planning
Execution

Exploit Cost Management flaw
Persist

Take over Cost Management module
Impact

Tamper with cost data and configuration

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated session in Oracle E-Business Suite holding a high-privileged responsibility with access to the Cost Management → Cost Planning component, HTTP/HTTPS reachability to the EBS application tier, and a supported affected release in the 12.2.3 through 12.2.15 band. Limiting factors: PR:H means anonymous or low-privileged EBS users cannot trigger it, no user interaction is required from a victim (UI:N), scope is unchanged so impact is confined to the Cost Management module rather than the wider EBS stack, and exposure shrinks materially when the EBS web tier is not reachable from untrusted networks.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High), but the practical risk is bounded by the PR:H requirement - the attacker must already hold an elevated EBS role with access to Cost Management functions, which is uncommon for external attackers and typical only for insiders or post-compromise pivoting. No EPSS score, KEV listing, or SSVC decision was provided, and no public POC is referenced, so this should be triaged as a standard Oracle CPU patch item rather than an emergency. One signal to verify: Oracle labels it 'easily exploitable' which conflicts with PR:H gating - this likely reflects exploit simplicity once authenticated, not unauthenticated reachability, and defenders should treat it as an insider/lateral-movement risk.
Exploit ScenarioDerived	A compromised or malicious insider holding a high-privileged EBS responsibility (for example a Cost Manager or Inventory super-user role) authenticates to the EBS web tier and issues a crafted HTTP request against the Cost Planning component, gaining full read/write/destroy control over Cost Management data and configuration. The same path is reachable post-compromise after an attacker steals or phishes credentials for any user already granted Cost Planning privileges; no public exploit is referenced but Oracle describes the issue as easily exploitable once the privilege precondition is satisfied.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Full compromise of Oracle Cost Management (component: Cost Planning) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, resulting in takeover of the module with high confidentiality, integrity, and availability impact. Oracle's Critical Patch Update for June 2026 (cspujun2026) classifies this as easily exploitable once the privilege prerequisite is met. No public exploit identified at time of analysis and no CISA KEV listing observed.

RemediationAI

Apply the patch available per vendor advisory in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); exact post-patch version numbers are published in the CPU matrix and should be applied to all EBS 12.2.3-12.2.15 installations. As compensating controls until the CPU can be rolled out, restrict assignment of Cost Management and Cost Planning responsibilities to the minimum set of users, review and prune existing high-privileged role grants in EBS, place the EBS application tier behind a network filter that only permits trusted internal sources (trade-off: blocks remote business users), and increase audit logging on Cost Planning forms and concurrent programs to detect abuse - trade-off being added log volume and potential noise for SOC review.

Affected VersionsENISA

Oracle Cost Management 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_cost_management no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in the Cost Planning component of Oracle Cost Management, a financial module within Oracle E-Business Suite (CPE cpe:2.3:a:oracle_corporation:oracle_cost_management) that calculates standard and actual costs across manufacturing and inventory flows. EBS exposes these modules over the Oracle Application Framework via HTTP servlets fronted by Oracle HTTP Server, so a privileged session within the EBS console can reach the affected handler. No CWE was assigned in the input, but the 'takeover of Oracle Cost Management' wording combined with C:H/I:H/A:H and PR:H is consistent with a missing authorization or unsafe deserialization/injection sink reachable from a privileged business role rather than a memory-corruption bug.

Know when Oracle Cost Management gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.2 HIGH

Network-reachable EBS HTTP endpoint with low complexity, but exploitation requires a high-privileged Cost Management responsibility (PR:H), no user interaction, unchanged scope, full CIA takeover of the module.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Cost Management (Cost Planning module) in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to full compromise via authenticated high-privilege access over HTTP. Organizations using these versions face risks of unauthorized cost data modification, financial reporting integrity compromise, and operational disruption of critical cost management functions. While exploitation requires authenticated high-privilege credentials, the sensitivity of cost data and insider threat potential make this a material organizational risk.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict Cost Planning module access to essential high-privilege users only; implement network segmentation to control HTTP connections to the module; enable comprehensive audit logging of all Cost Planning activities and user actions; require multi-factor authentication for high-privilege Cost Planning access; contact Oracle support for tactical workarounds pending patch availability.

Threat Intelligence Overview

EPSS Score

0.5%

Top 63% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.