This vulnerability is present in the Cost Planning component of Oracle Cost Management. An attacker with low privileges and network access over HTTP can exploit a flaw that permits remote code execution, thereby compromising confidentiality, integrity, and availability. Successful exploitation can result in full takeover of the application.

Affected product is Oracle Cost Management, part of Oracle E‑Business Suite, specifically the Cost Planning module. Vulnerable versions range from 12.2.3 through 12.2.15, and the issue impacts any instance of the product connected to external networks via HTTP.

The CVSS 3.1 base score of 8.8 signifies high severity. The attack vector is network‑based (AV:N) and requires low privilege (PR:L). No EPSS data exists, so the current exploitation probability is unknown. This vulnerability is not listed in CISA’s KEV catalog, but the impact levels (C, I, A) signal a potentially severe compromise. An attacker with minimal local or network access can execute arbitrary code remotely through the exposed HTTP interface.