Cost Management
Monthly
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.