Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Costing Transaction Errors). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html |
|
History
Wed, 05 Aug 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | HTTP Access Exploit Enables Full Compromise of Oracle Cost Management | |
| Weaknesses | CWE-285 |
Tue, 04 Aug 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | HTTP-Based Low‑Privilege Attack Results in Full Control of Oracle Cost Management | |
| Weaknesses | CWE-284 |
Thu, 30 Jul 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | HTTP-Based Low‑Privilege Attack Results in Full Control of Oracle Cost Management | |
| Weaknesses | CWE-284 |
Tue, 28 Jul 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Low-Privilege HTTP Exploitation Enables Takeover of Oracle Cost Management | |
| Weaknesses | CWE-284 |
Fri, 24 Jul 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Low-Privilege HTTP Exploitation Enables Takeover of Oracle Cost Management | |
| Weaknesses | CWE-284 |
Tue, 21 Jul 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Costing Transaction Errors). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). | |
| First Time appeared |
Oracle
Oracle cost Management |
|
| CPEs | cpe:2.3:a:oracle:cost_management:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle cost Management |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-07-21T21:37:01.215Z
Updated: 2026-07-24T15:19:25.299Z
Reserved: 2026-07-08T15:51:55.592Z
Link: CVE-2026-60806
Vulnrichment
No data.
NVD
No data.
Redhat
No data.