Oracle Cost Management EUVD-2026-46463

Exploitation requires an authenticated, low-privileged Oracle E-Business Suite account (PR:L) with HTTP network access to the EBS web tier hosting the Cost Management module, specifically the Cost Maintenance component. Oracle rates the vulnerability difficult to exploit (AC:H), indicating additional conditions outside the attacker's control - such as specific application state, timing, or configuration - must be met, which meaningfully limits real-world exploitation. No user interaction is needed (UI:N). The affected deployment must be EBS 12.2.3 through 12.2.15; releases outside that range and unauthenticated external attackers without an EBS login are not in scope per the CVSS vector.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Two mitigating signals stand out: high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control or significant effort, and required low privileges (PR:L), meaning the attacker must already hold a valid EBS account. Offsetting these, the triple-high impact (C:H/I:H/A:H) equals full module takeover, the vector is network-reachable (AV:N), and no user interaction is needed (UI:N). No EPSS score, SSVC decision, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified - the absence of these signals suggests a vendor-disclosed issue not yet observed being exploited rather than an active threat. Net assessment: a real but not emergency priority for organizations running EBS, warranting inclusion in the standard Oracle CPU patch cycle rather than out-of-band response. Note that the 'Information Disclosure' tag versus the 'takeover' description language is a minor inconsistency - verify exact impact with Oracle.

An attacker who has obtained or been granted a low-privilege Oracle EBS account authenticates to the application's web tier and sends specially crafted HTTP requests to the Cost Maintenance functionality of Oracle Cost Management. By meeting the difficult-to-satisfy preconditions (AC:H), the attacker escalates from limited access to full takeover of the module, reading and altering costing data and disrupting availability. No public proof-of-concept is known at time of analysis.