Executive brief
A vulnerability exists in Oracle Cost Management, a component of the Oracle E-Business Suite used by organizations to track and manage manufacturing and inventory costs. A low-privileged user could exploit this flaw to gain full control over the Cost Management system. This could lead to the unauthorized modification of financial records, theft of sensitive cost data, or disruption of accounting operations.
Technical details
This vulnerability affects the Costing Transaction Errors component of Oracle Cost Management within the Oracle E-Business Suite. It is classified as a high-complexity exploit that requires the attacker to have low-level user privileges and network access via HTTP. Successful exploitation allows for a complete takeover of the Oracle Cost Management product, impacting the confidentiality, integrity, and availability of the system. The vulnerability is present in versions 12.2.3 through 12.2.15. Oracle addressed this issue in the July 2026 Critical Patch Update.
Affected products
- Oracle Cost Management (E-Business Suite) 12.2.3-12.2.15
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory