A flaw exists in the Cost Maintenance component of Oracle Cost Management that permits an attacker with low privileges and network access over HTTP to compromise the application. When exploited, the attacker can gain full control of Oracle Cost Management, impacting confidentiality, integrity, and availability of all cost‑related data and processes.

Oracle Cost Management, part of Oracle E‑Business Suite, is affected in release versions 12.2.3 through 12.2.15. The product interfaces through HTTP on the Oracle E‑Business Suite environment.

The vulnerability has a CVSS v3.1 Base Score of 7.5, indicating moderate to high severity. No EPSS estimate is available, and the issue is not listed in CISA KEV, suggesting no known large‑scale exploitation. A remote attacker needs only network connectivity to the HTTP service and low‑privilege credentials to evade more restrictive controls. Given the high impact on all aspects of the application and the relatively low barrier to access, the risk to impacted environments is significant.