This vulnerability affects Oracle Cost Management version V16 and allows a high privileged attacker with network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, or modification. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. The vendor advisory references Oracle's Critical Patch Update for July 2026 but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying available patches promptly to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Cost Management, as well as unauthorized access to all accessible data in the product. This compromises confidentiality and integrity of the data but does not affect availability. The attacker must have high privileges and network access via HTTP to exploit this vulnerability.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends that customers remain on actively-supported versions and apply security patches without delay as part of their Critical Patch Update process. No specific temporary or official fix is stated in the advisory for this vulnerability at this time.