This vulnerability affects Oracle Cost Management within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It requires a high privileged attacker with network access over HTTP and no user interaction to exploit. Successful exploitation can lead to complete compromise of Oracle Cost Management, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and unchanged scope. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for it. No known exploits in the wild have been reported.

If exploited, this vulnerability can result in full takeover of Oracle Cost Management, affecting the confidentiality, integrity, and availability of the affected system. This could allow an attacker with high privileges and network access to perform unauthorized actions within Oracle Cost Management.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a dedicated patch or remediation for this specific vulnerability. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Until official patches or mitigations are confirmed, organizations should ensure that only trusted, high privileged users have network access to Oracle Cost Management and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.