Description
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution available to low‑privileged attackers via HTTP, enabling full takeover of Oracle Cost Management
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is present in the Cost Planning component of Oracle Cost Management. An attacker with low privileges and network access over HTTP can exploit a flaw that permits remote code execution, thereby compromising confidentiality, integrity, and availability. Successful exploitation can result in full takeover of the application.

Affected Systems

Affected product is Oracle Cost Management, part of Oracle E‑Business Suite, specifically the Cost Planning module. Vulnerable versions range from 12.2.3 through 12.2.15, and the issue impacts any instance of the product connected to external networks via HTTP.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 signifies high severity. The attack vector is network‑based (AV:N) and requires low privilege (PR:L). The EPSS score of < 1% (0.00533) indicates a low probability that the vulnerability will be widely exploited. This vulnerability is not listed in CISA’s KEV catalog, but the impact levels (C, I, A) signal a potentially severe compromise. An attacker with minimal local or network access can execute arbitrary code remotely through the exposed HTTP interface.

Generated by OpenCVE AI on October 29, 2026 at 21:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or upgrade from version 12.2.15 to a patched release that resolves the code execution flaw.
  • Restrict HTTP access to the Cost Planning interface by firewalling or using a VPN so that only authorised personnel can reach it.
  • Deploy web application firewall rules or input validation checks to block malformed requests that may trigger the vulnerability while awaiting the patch.

Generated by OpenCVE AI on October 29, 2026 at 21:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Code Execution via HTTP in Oracle Cost Management

Thu, 29 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Low‑Privilege HTTP in Oracle Cost Management
Weaknesses CWE-94

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Low‑Privilege HTTP in Oracle Cost Management
Weaknesses CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle cost Management
CPEs cpe:2.3:a:oracle:cost_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle cost Management
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Cost Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:50.048Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101567

cve-icon Vulnrichment

Updated: 2026-10-29T10:41:23.590Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:08.693

Modified: 2026-10-29T11:17:21.797

Link: CVE-2026-101567

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T21:15:15Z

Weaknesses