CVE-2026-46929: High severity Oracle Oracle Cost Management vulnerability
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Cost Management (Oracle E-Business Suite) - Cost Planningto a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs a low-privileged account and network access to the affected Oracle Cost Management Cost Planning component over HTTP. No user interaction is required.
Which deployments are known to be affected?
Affected supported versions are Oracle Cost Management 12.2.3 through 12.2.15, specifically the Cost Planning component. The provided information does not state whether any configuration changes are required for exposure.
What is the potential impact of successful exploitation?
Successful exploitation can allow takeover of Oracle Cost Management, with high impact to confidentiality, integrity, and availability.