What is the CVSS score of EUVD-2026-37255?

EUVD-2026-37255 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Cost Management are affected by EUVD-2026-37255?

Oracle E-Business Suite Cost Management (versions 12.2.3-12.2.15) contains a critical vulnerability enabling any authenticated EBS user to remotely compromise the entire Cost Planning system,…

How to fix or mitigate EUVD-2026-37255?

24 hours: Identify all production systems running Oracle EBS 12.2.3-12.2.15; document user accounts with Cost Planning module access; enable comprehensive logging of Cost Management API activity. 7 days: Restrict Cost Planning network access to essential personnel using firewall rules; audit and remove unnecessary Cost Management privileges; implement real-time alerting on privilege escalation attempts within Cost Planning transactions. 30 days: Monitor Oracle Critical Patch Update announcements for fixes to this CVE; develop upgrade plan targeting Oracle EBS 12.2.16 or newer versions; validate that compensating controls do not impede business-critical Cost Planning workflows.

Oracle Cost Management EUVD-2026-37255

| CVE-2026-46940 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Privilege Escalation Oracle Oracle Cost Management Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable EBS web tier with low complexity; PR:L because a valid EBS application account is required; UI:N and full CIA impact consistent with vendor-stated 'takeover' of the module.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:00 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Cost Management (component: Cost Planning) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). The advisory was published in Oracle's June 2026 Critical Patch Update and no public exploit identified at time of analysis. Because the EBS Cost Management module is commonly reachable from internal corporate networks by any authenticated EBS user, the low privilege requirement (PR:L) makes this a credible insider/post-foothold escalation path rather than an unauthenticated internet risk.

Technical ContextAI

Oracle Cost Management is a financial subledger module within Oracle E-Business Suite (EBS) responsible for inventory valuation, cost rollups, and cost planning workflows; it is delivered through the EBS web tier (Oracle HTTP Server / Oracle Application Framework / Forms) over HTTP and backed by the Oracle Database. The affected Cost Planning component handles cost simulation and planning data, typically exposed through OA Framework pages reachable via the EBS application URL. No CWE is published by Oracle, but the CVSS profile (network HTTP, low complexity, low privileges, full CIA impact, scope unchanged) is consistent with the classic EBS web-tier injection or authorization-bypass pattern seen repeatedly across the 12.2.x branch in prior Oracle CPUs, where an authenticated EBS application user can reach a privileged backend operation that should have been restricted to administrators.

RemediationAI

Apply the Oracle June 2026 Critical Patch Update fixes for Oracle E-Business Suite Cost Management as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle publishes per-version patch numbers in My Oracle Support notes referenced from that advisory, so identify the patch corresponding to your exact 12.2.x baseline (12.2.3 through 12.2.15) and apply it via adop in the EBS R12.2 online patching cycle. Patch available per vendor advisory; no exact fixed sub-version is published in the input data beyond the CPU itself. If the CPU cannot be applied immediately, restrict reachability of the Cost Management responsibilities and OA Framework pages: remove the Cost Management responsibility from non-finance users, enforce IP allow-listing or VPN-only access to the EBS application URL at the load balancer or Oracle HTTP Server, enable EBS URL Firewall (FND: URL Firewall) to restrict allowed servlet paths, and audit FND_USER for stale or shared low-privileged accounts since PR:L is the only barrier to exploitation. Note that restricting responsibilities can disrupt legitimate cost planners and that URL Firewall changes have historically broken third-party integrations, so stage them in a test instance first.