A vulnerability in the Costing Transaction Errors component of Oracle Cost Management allows a low‑privileged attacker with network access via HTTP to compromise the application. If successfully exploited, the attacker can gain full control of Oracle Cost Management, potentially exposing, altering, or destroying the confidentiality, integrity, and availability of the data and processes managed by the system. The CVSS v3.1 base score of 7.5 reflects significant impact across all core security properties.

Oracle Corporation’s Oracle Cost Management product, part of Oracle E‑Business Suite, is affected. Versions 12.2.3 through 12.2.15 are listed as vulnerable.

The CVSS score indicates a high severity vulnerability. While the EPSS score of less than 1% suggests a low probability of widespread exploitation, the lack of a KEV listing does not diminish the potential damage should an attacker succeed. The described exploitation path involves a low‑privileged attacker with network access via HTTP, meaning that once network access is achieved, the attacker can potentially compromise the entire Cost Management component. No public exploitation is reported, but the impact could be severe if exploited.