This vulnerability in Oracle Cost Management (component: Cost Planning) affects supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the system, potentially resulting in full takeover of Oracle Cost Management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update advisory. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to complete compromise of Oracle Cost Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially disrupting business operations and exposing sensitive data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update which includes fixes for this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. Oracle advises customers to remain on actively-supported versions and apply security patches without delay. Patch status is not explicitly stated in the advisory text, but the vulnerability is included in the June 2026 Critical Security Patch Update, indicating an official fix is available.