CVE-2026-60165 in Cost Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Enterprise Command Center). The supported version that is affected is V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Cost Management, a component of the Oracle E-Business Suite that operates under the Enterprise Command Center framework. The affected version V16 represents a significant security weakness that exposes organizations to targeted attacks from high-privileged adversaries who can leverage network-based HTTP access to compromise the system. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to successfully exploit the flaw, making it particularly dangerous for organizations that do not maintain robust security controls. The CVSS 3.1 base score of 6.5 reflects a medium-high severity threat that specifically targets both confidentiality and integrity aspects of the affected system.
The technical nature of this vulnerability allows attackers with high privileges and network access via HTTP to gain unauthorized access to critical data within Oracle Cost Management. This encompasses the ability to create, delete, or modify sensitive information that flows through the cost management processes, potentially leading to complete data compromise across all accessible Oracle Cost Management systems. The attack vector specifically utilizes HTTP network protocols, suggesting that the vulnerability may stem from inadequate input validation, authentication bypass mechanisms, or improper access controls within the web interface components of the Enterprise Command Center. This flaw represents a serious security weakness that could enable attackers to manipulate financial and operational cost data, potentially causing significant business disruption and regulatory compliance issues.
The operational impact of this vulnerability extends beyond simple data exposure to encompass complete modification capabilities that could fundamentally alter organizational cost accounting processes. Attackers could potentially delete critical cost management data, introduce fraudulent entries, or modify existing records to distort financial reporting and decision-making processes. The confidentiality and integrity impacts are particularly severe as they affect the core business operations that rely on accurate cost management data for budgeting, forecasting, and operational planning. Organizations using this vulnerable version face the risk of financial losses, compliance violations under standards such as SOX, and potential legal consequences from data manipulation or loss. The successful exploitation could also provide attackers with insights into organizational cost structures and business processes that might be leveraged for further attacks.
Organizations should immediately implement patch management procedures to upgrade to supported versions of Oracle E-Business Suite that address this vulnerability. Network segmentation and access control measures should be enhanced to limit HTTP access to only authorized personnel with legitimate business needs. Monitoring systems should be configured to detect unusual patterns in cost management data access or modifications that might indicate exploitation attempts. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and credential access. Security teams should conduct thorough assessments of their current access controls and implement defense-in-depth strategies including multi-factor authentication, regular security audits, and continuous monitoring of cost management system activities to prevent unauthorized modifications that could compromise financial integrity and operational effectiveness.