CVE-2026-60806
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Costing Transaction Errors). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Cost Management, a critical component of the Oracle E-Business Suite ecosystem that manages financial costing and inventory valuation processes. The flaw specifically affects the Costing Transaction Errors module, which handles transaction processing and error management for cost calculations across enterprise environments. Organizations running Oracle E-Business Suite versions 12.2.3 through 12.2.15 face exposure to this security weakness, representing a substantial attack surface given the widespread deployment of these legacy versions across enterprise infrastructure.
The technical nature of this vulnerability manifests as a difficulty in exploitation scenario that requires a low-privileged attacker with network access via HTTP protocols to achieve successful compromise. This classification indicates that while the attack vector is accessible through standard web communication channels, the complexity of execution prevents casual exploitation attempts. The vulnerability's CVSS 3.1 base score of 7.5 reflects high severity across all three impact dimensions, indicating potential compromise of confidentiality, integrity, and availability of the targeted system. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) demonstrates that network-based attacks require high attack complexity but can be executed by low-privileged users without user interaction, while the unshared scope suggests impacts extend beyond the immediate target.
The operational impact of successful exploitation represents a severe threat to enterprise financial operations and data integrity. A compromised Oracle Cost Management system could enable attackers to manipulate cost calculations, alter inventory valuations, and potentially disrupt critical business processes that depend on accurate costing data. This vulnerability directly threatens the financial accuracy of enterprise operations, as costing errors can cascade through supply chain management, financial reporting, and operational decision-making systems. The availability impact suggests potential disruption of critical costing services, while confidentiality breaches could expose sensitive financial data and business strategies to unauthorized parties.
Organizations should prioritize immediate remediation through official Oracle security patches and updates addressing this specific vulnerability. Network segmentation and access controls should be implemented to limit exposure of the affected system to untrusted networks. Regular security assessments of legacy Oracle E-Business Suite installations are essential, particularly given the extended support lifecycle of these versions. Security monitoring should focus on anomalous HTTP traffic patterns and unauthorized access attempts targeting Cost Management interfaces. The vulnerability aligns with CWE-20 (Improper Input Validation) and potentially CWE-79 (Cross-site Scripting) categories, with exploitation techniques mapping to ATT&CK tactics including initial access through web application attacks and privilege escalation via system compromise. Organizations should also consider implementing network intrusion detection systems specifically configured to identify patterns associated with this vulnerability class.