This vulnerability affects Oracle Cost Management within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable flaw that allows an attacker with high privileges and network access via HTTP to compromise the product, potentially leading to complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-46938 and is included in Oracle's June 2026 Critical Security Patch Update advisory. While the advisory lists many patched products and versions, it does not explicitly confirm a dedicated patch for this specific vulnerability or provide a remediation level. Oracle advises customers to apply the Critical Security Patch Update without delay and consider interim mitigations such as blocking attack vectors or removing unnecessary privileges.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle Cost Management, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected Oracle Cost Management component within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The CVSS score of 7.2 reflects a high severity impact.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update. Customers are strongly advised to apply this update promptly to remediate the vulnerability. The vendor advisory does not explicitly confirm a standalone patch for CVE-2026-46938 but recommends applying the full Critical Security Patch Update. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may affect application functionality. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.