Oracle Cost Management
Monthly
Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Cost Management (component: Cost Planning) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). The advisory was published in Oracle's June 2026 Critical Patch Update and no public exploit identified at time of analysis. Because the EBS Cost Management module is commonly reachable from internal corporate networks by any authenticated EBS user, the low privilege requirement (PR:L) makes this a credible insider/post-foothold escalation path rather than an unauthenticated internet risk.
Full compromise of Oracle Cost Management (component: Cost Planning) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, resulting in takeover of the module with high confidentiality, integrity, and availability impact. Oracle's Critical Patch Update for June 2026 (cspujun2026) classifies this as easily exploitable once the privilege prerequisite is met. No public exploit identified at time of analysis and no CISA KEV listing observed.
Account takeover in Oracle Cost Management (E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the Cost Planning component over HTTP. The flaw yields high confidentiality, integrity, and availability impact with no user interaction required, and is addressed in Oracle's June 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, network-accessible nature warrants priority patching by EBS operators.
Oracle Cost Management V16 (Enterprise Command Center component) exposes critical data to compromise by network-accessible, high-privileged attackers over HTTP. Successful exploitation grants unauthorized read access to all accessible data and the ability to create, delete, or modify critical records within the application - a dual confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though it was disclosed as part of Oracle's CPU July 2026 advisory cycle.
Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Cost Management (component: Cost Planning) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). The advisory was published in Oracle's June 2026 Critical Patch Update and no public exploit identified at time of analysis. Because the EBS Cost Management module is commonly reachable from internal corporate networks by any authenticated EBS user, the low privilege requirement (PR:L) makes this a credible insider/post-foothold escalation path rather than an unauthenticated internet risk.
Full compromise of Oracle Cost Management (component: Cost Planning) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker over HTTP, resulting in takeover of the module with high confidentiality, integrity, and availability impact. Oracle's Critical Patch Update for June 2026 (cspujun2026) classifies this as easily exploitable once the privilege prerequisite is met. No public exploit identified at time of analysis and no CISA KEV listing observed.
Account takeover in Oracle Cost Management (E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged remote attacker to fully compromise the Cost Planning component over HTTP. The flaw yields high confidentiality, integrity, and availability impact with no user interaction required, and is addressed in Oracle's June 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, network-accessible nature warrants priority patching by EBS operators.
Oracle Cost Management V16 (Enterprise Command Center component) exposes critical data to compromise by network-accessible, high-privileged attackers over HTTP. Successful exploitation grants unauthorized read access to all accessible data and the ability to create, delete, or modify critical records within the application - a dual confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though it was disclosed as part of Oracle's CPU July 2026 advisory cycle.