CVE-2026-60340 in Project Costing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Costing. Successful attacks of this vulnerability can result in takeover of Oracle Project Costing. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Costing, a component of the Oracle E-Business Suite that operates within the Enterprise Command Center framework. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial release range where this security flaw persists. The vulnerability's exploitability characteristics present a concerning threat landscape as it requires only high privileged access and network connectivity via HTTP to achieve successful compromise. This classification places the vulnerability in the easily exploitable category, suggesting that attackers with sufficient privileges can leverage this weakness without requiring extensive technical expertise or specialized tools.
The technical nature of this flaw involves a privilege escalation mechanism that allows an attacker who already possesses high-level system permissions to further compromise the Oracle Project Costing module. The CVSS 3.1 score of 7.2 reflects the severity across three critical impact vectors: confidentiality, integrity, and availability. When fully exploited, this vulnerability can result in complete takeover of the Oracle Project Costing functionality, fundamentally undermining the security posture of organizations relying on this financial management component. The attack vector is classified as network-based with low access complexity, meaning that even a sophisticated attacker could potentially leverage this weakness with minimal technical barriers.
The operational impact extends beyond simple data compromise to encompass full system control and potential business disruption. Organizations utilizing Oracle Project Costing for project financial management and resource allocation face significant risk of unauthorized access to sensitive budgetary information, modification of financial records, and potential service denial that could affect critical business operations. The vulnerability's presence in the Enterprise Command Center component suggests that attackers could potentially access broader enterprise financial data streams and command structures that integrate with other Oracle E-Business Suite modules.
Security professionals should recognize this vulnerability as aligning with CWE-284 (Improper Access Control) and potentially CWE-310 (Cryptographic Issues) depending on the specific implementation details. The ATT&CK framework would categorize this under privilege escalation techniques, specifically targeting enterprise application access control mechanisms. Mitigation strategies should include immediate patch deployment through Oracle's security updates, network segmentation to limit HTTP access to privileged systems, and enhanced monitoring of HTTP traffic for suspicious activity patterns. Organizations must also consider implementing additional access controls and authentication layers beyond the default Oracle E-Business Suite configurations to reduce the attack surface and prevent exploitation attempts.