CVE-2026-46940: Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning)

Synopsis

An unspecified high-severity vulnerability exists in the Cost Planning component of Oracle Cost Management, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no user interaction needed. Successful exploitation gives an attacker full control over the affected Oracle Cost Management instance, impacting confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Cost Management HTTP service over the network; no physical or local access is needed.

• AuthenticationRequired

  Any low-privileged account with network access is sufficient; no administrative credentials are required.

• Victim interactionNot required

  The attack completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• A successful attacker reads all data accessible to the Oracle Cost Management application, including cost plans, pricing records, and any credentials or session tokens stored within the component.
• The attacker can modify or delete persisted cost and planning data, corrupting financial records and production cost calculations.
• The attacker can crash or render the Oracle Cost Management service unavailable, disrupting procurement and manufacturing cost workflows.
• Full application takeover means the attacker can pivot to other E-Business Suite components or backend database connections reachable from the compromised service.