This vulnerability affects Oracle Cost Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and no user interaction, allowing complete compromise of the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory, which includes 245 security fixes across multiple products including Oracle E-Business Suite. The advisory strongly urges customers to apply the patches promptly. While no specific patch version for Oracle Cost Management is explicitly stated, the advisory covers versions 12.2.3 to 12.2.15 of Oracle E-Business Suite, indicating these versions are affected. Oracle also recommends mitigating risk by blocking network protocols used in attacks and removing unnecessary privileges until patches are applied.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Cost Management. This results in complete loss of confidentiality, integrity, and availability of the affected product. The vulnerability enables takeover of Oracle Cost Management, potentially impacting business operations relying on this component.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. The vendor advisory does not specify a separate patch outside this update. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality and should be applied cautiously. Oracle advises customers to remain on actively supported versions and to apply security patches without delay.