EUVD-2026-47077
GHSA-wph6-xq94-xr56
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Cost Management HTTP endpoint
-
ExploitSend crafted request bypassing authorization
-
ExecutionRead or modify module-accessible cost/inventory data
-
ImpactExfiltrate or tamper with critical business data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle E-Business Suite web tier and a valid low-privileged application account (CVSS PR:L) - it is not pre-authentication despite the 'Authentication Bypass' tag. The target must be running an affected release in the 12.2.3-12.2.15 range with the Cost Management module (Internal Operations component) deployed and reachable. Limiting factors: a working authenticated session/credential is mandatory, and the impact is confined to data the Cost Management module can access (no availability/DoS effect); exposure is further limited where the EBS web tier is restricted to internal networks rather than internet-facing. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a genuinely reachable, low-complexity, network-facing issue requiring only low privileges and no user interaction - a realistic priority for any internet- or intranet-exposed EBS deployment. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the absence of KEV/POC signals means this is not confirmed as actively exploited, and should be treated as a patch-on-cycle-to-urgent item rather than an emergency zero-day. One conflict to verify: the vendor 'Authentication Bypass' tag implies unauthenticated access, but the CVSS vector explicitly encodes PR:L (a valid low-privileged account is required) - the CVSS vector, being more structured, should be trusted for prioritization, but defenders should confirm with Oracle whether any pre-authentication path exists. The lack of availability impact (A:N) means this is a data-exposure/tampering risk, not a DoS. |
| Exploit ScenarioDerived | An attacker who holds or phishes a valid low-privileged Oracle EBS account sends crafted HTTP requests to the Cost Management Internal Operations endpoints and, due to insufficient authorization enforcement, reads and alters cost/inventory data belonging to the entire module. Because attack complexity is low and no user interaction is needed, the actions can be scripted for bulk data exfiltration or tampering; no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's designated fix for CVE-2026-60741 across EBS 12.2.3-12.2.15 - patch available per vendor advisory, though no single standalone fix version was published in the input beyond the CPU bundle, so identify the exact EBS patch number for your release from the CPU advisory before deployment. As compensating controls until the CPU is applied, restrict network reachability of the affected Cost Management/Internal Operations pages to trusted internal segments (avoid exposing EBS directly to the internet), tighten which application responsibilities/roles can reach the module and review low-privilege account provisioning to shrink the pool of accounts that meet the PR:L prerequisite, and enable web-tier logging/WAF rules on the EBS HTTP entry points to detect anomalous access to cost/inventory endpoints; note these controls reduce exposure but do not remove the vulnerability and may disrupt legitimate integrations that call the module remotely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Cost Management is an inventory/costing module within the Oracle E-Business Suite (EBS) ERP platform, exposed through the web/HTTP tier of the suite (the affected 12.2.x line runs on the Oracle Application Framework and WebLogic-based application services). The vulnerable 'Internal Operations' component handles cost and inventory transactions, so the impacted data is business-critical financial and operational records. No CWE was assigned by NVD, so the precise root-cause class is unconfirmed; however, the vendor's own 'Authentication Bypass' tag combined with a C:H/I:H impact profile is consistent with a broken access-control or authorization weakness (e.g., CWE-284/CWE-862-style missing or improper authorization on an EBS servlet/endpoint) that lets an authenticated user reach data outside their intended scope.
Know when Cost Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP reach with low complexity and a required low-privilege account (PR:L, not PR:N given the CVSS vector); high confidentiality and integrity data impact, no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Cost Management in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity vulnerability (CVSS 8.1) that allows low-privileged users with network access to read, create, delete, or modify financial and operational data within the module. No vendor-released patch has been identified at time of analysis. Organizations using affected versions face immediate risk of unauthorized data manipulation and must implement access controls to protect financial records.
Restrict network and application-level access to the Cost Management module to authenticated administrative personnel only. Implement role-based access controls limiting Cost Management privileges to necessary finance and operations staff. Disable data export and modification functionality for non-administrative users. Enable comprehensive audit logging with real-time alerting for Cost Management data creation, deletion, and modification events. Conduct weekly data integrity validation on critical financial records and perform daily reviews of Cost Management transaction logs for suspicious activity. Monitor authentication and privilege escalation attempts targeting Cost Management accounts. Maintain these interim controls until the system can be upgraded to a patched version and changes are validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cost Management
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Inter
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highl
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enab
Exploit-DB