This vulnerability in Oracle Cost Management (part of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the product, leading to complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly state patch availability or remediation details for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of Oracle Cost Management, impacting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over the affected product, potentially disrupting business operations and exposing sensitive data.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches promptly. Until official patches or mitigations are confirmed, organizations should limit network access to Oracle Cost Management interfaces to trusted users with high privileges and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.