Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cost Management. CVSS 3.1 Base Score 6.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html |
|
History
Wed, 05 Aug 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Access Control Failure in Oracle Cost Management Allows Data Manipulation and Partial DoS | |
| Weaknesses | CWE-284 |
Sun, 02 Aug 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control in Oracle Cost Management Enables Unauthorized Data Manipulation and Partial DoS | |
| Weaknesses | CWE-284 |
Thu, 30 Jul 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control in Oracle Cost Management Enables Unauthorized Data Manipulation and Partial DoS | |
| Weaknesses | CWE-284 |
Tue, 28 Jul 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Network-Based Privileged Attack Allows Unauthorized Data Modification in Oracle Cost Management | |
| Weaknesses | CWE-284 |
Thu, 23 Jul 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Network-Based Privileged Attack Allows Unauthorized Data Modification in Oracle Cost Management | |
| Weaknesses | CWE-284 |
Tue, 21 Jul 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cost Management. CVSS 3.1 Base Score 6.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L). | |
| First Time appeared |
Oracle
Oracle cost Management |
|
| CPEs | cpe:2.3:a:oracle:cost_management:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle cost Management |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-07-21T21:37:00.879Z
Updated: 2026-07-24T15:19:31.435Z
Reserved: 2026-07-08T15:51:55.592Z
Link: CVE-2026-60805
Vulnrichment
No data.
NVD
No data.
Redhat
No data.