CVE-2026-46938: Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning)

Synopsis

An unspecified vulnerability in the Cost Planning component of Oracle Cost Management, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is reachable over the network via HTTP. Exploitation requires a high-privileged account but no victim interaction, and the attack complexity is low. Successful exploitation gives an attacker full control over the affected component, impacting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Cost Management service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationRequired

  A high-privileged account (such as an administrative user) is required; low-privilege or anonymous access is not sufficient.

• Victim interactionNot required

  No action from a victim user is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Cost Management application, including cost plans, pricing records, and any credentials or tokens stored in the component.
• The attacker can modify or delete persisted cost planning data, corrupting financial records and planning outputs.
• The attacker can crash or render the Oracle Cost Management service unavailable, disrupting cost planning operations.
• Because all three impact dimensions (confidentiality, integrity, availability) score HIGH, the practical outcome is a full takeover of the affected component.