This vulnerability affects Oracle Cost Management versions 12.2.3 to 12.2.15 and involves a flaw that can be exploited by a low privileged attacker over the network via HTTP. The attack complexity is high, requiring some conditions to be met, but no user interaction is needed. Successful exploitation can lead to full compromise of Oracle Cost Management, impacting confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). The vendor advisory from Oracle references a Critical Patch Update released in July 2026 that addresses multiple vulnerabilities, but does not explicitly confirm patch availability or remediation status for this specific CVE in the provided content.

If exploited, this vulnerability can result in complete takeover of Oracle Cost Management, affecting confidentiality, integrity, and availability of the system. This could allow unauthorized access and control over cost management functions within Oracle E-Business Suite.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Cost Management and monitor for suspicious activity related to this component.