Oracle Cost Management EUVD-2026-47487

Exploitation requires: (1) network access to the Oracle E-Business Suite application layer over HTTP - the component must be reachable from the attacker's position; (2) a highly privileged Oracle EBS account (PR:H) - the attacker must possess or have compromised credentials with elevated EBS role assignments, representing a substantial barrier to exploitation for external attackers; (3) high attack complexity (AC:H) - specific conditions beyond the attacker's direct control must be present, such as particular application states, race conditions, or configuration prerequisites; Oracle has not publicly disclosed the precise nature of these conditions. What limits exploitation: the PR:H requirement effectively excludes unauthenticated and low-privilege attackers from direct exploitation; AC:H further constrains opportunistic or automated exploitation. Only Oracle EBS deployments running Cost Management versions 12.2.3 through 12.2.15 are confirmed in scope.

The CVSS base score of 6.6 is substantially suppressed by two high-barrier metrics: PR:H (a highly privileged EBS account is required) and AC:H (non-trivial exploitation conditions must be met), even though all three impact dimensions rate as High, representing full system takeover upon success. This creates a risk profile where raw CVSS impact overstates accessible risk for most environments - the realistic attacker pool is limited to those who already possess or have compromised high-privilege EBS credentials. EPSS probability data is absent from the provided intelligence, precluding a quantitative exploitation-likelihood assessment. CISA KEV status is not confirmed (not listed), and no proof-of-concept exploit code has been identified, further reducing near-term opportunistic exploitation risk. The tag 'Information Disclosure' is inconsistent with the CVSS C:H/I:H/A:H vector and the description of 'takeover' - the tag likely reflects an incomplete classification; the CVSS vector and description should be treated as authoritative for impact scope. For organizations where EBS Cost Management is internet-facing or where privileged EBS account credentials are broadly distributed or at elevated compromise risk, the residual risk remains meaningful despite the moderate score.

An attacker who has obtained high-privilege Oracle EBS credentials - through phishing, credential stuffing, insider access, or compromise of an administrator workstation - accesses the Cost Planning component over HTTP and crafts a request that satisfies the high-complexity exploitation conditions (the exact nature of which Oracle has not publicly disclosed). Upon successful exploitation, the attacker gains full control over Oracle Cost Management, enabling unauthorized read and modification of cost planning data, potential disruption of manufacturing and supply chain costing functions, and full availability impact on the component. No public exploit code is known to exist at time of analysis.