Executive brief
A vulnerability exists in Oracle Cost Management, a component of the Oracle E-Business Suite used by organizations to track and manage inventory costs. A high-privileged attacker could exploit this flaw to gain full control over the Cost Management system. This could lead to the unauthorized modification of financial data, theft of sensitive inventory information, or disruption of accounting operations.
Technical details
A vulnerability in the Inventory Costing component of Oracle Cost Management (part of Oracle E-Business Suite) allows for a complete system takeover. The flaw is easily exploitable by a high-privileged attacker with network access via HTTP. Successful exploitation grants the attacker full control over Confidentiality, Integrity, and Availability of the affected component. The vulnerability affects versions 12.2.3 through 12.2.15. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Cost Management 12.2.3-12.2.15
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory