A vulnerability in Oracle Cost Management allows an attacker with low‑privileged network access via HTTP to execute privileged actions that compromise the entire application. The flaw results in confidentiality, integrity, and availability loss that effectively grants the attacker full control of the system. Based on the description, the issue appears to be an improper privilege management flaw, potentially aligning with CWE-269. This suggests that a low‑privileged user can gain elevated privileges within the application.

Oracle Cost Management, part of Oracle E‑Business Suite, Cost Planning module. Versions 12.2.3 through 12.2.15 are affected. The product is provided by Oracle Corporation and no other versions are listed as vulnerable.

The CVSS score of 8.8 reflects high severity. EPSS <1% indicates a low probability of exploitation, but the network‑based attack vector means an attacker could deliver simple HTTP requests to gain control without advanced skills. The vulnerability is not listed in the CISA KEV catalog, but its severity and ease of exploitation make it a significant risk for organizations running the affected versions.