CVE-2026-46929: Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning)

Synopsis

An unspecified vulnerability in the Cost Planning component of Oracle Cost Management (part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is reachable over the network via HTTP. An attacker holding any low-privilege account can exploit it without requiring additional user interaction. Successful exploitation results in full takeover of Oracle Cost Management, giving the attacker read, write, and denial-of-service control over the affected instance. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Cost Management service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No action from any user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layouts, or environmental prerequisites are required.

Blast Radius

• Reads all data accessible to Oracle Cost Management, including cost plans, pricing records, and any stored credentials or session tokens within the application.
• Modifies or deletes cost planning records and persisted application data, enabling financial data manipulation.
• Crashes or degrades the Oracle Cost Management service, disrupting cost planning operations for all users of the affected instance.
• Achieves full application-level takeover, meaning an attacker can chain access to other E-Business Suite components reachable from the compromised service.