CVE-2026-61004 in Landed Cost Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Landed Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Landed Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Landed Cost Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability resides within Oracle Landed Cost Management, a component of the Oracle E-Business Suite that handles import cost calculations and financial tracking for organizations. The affected versions spanning 12.2.3 through 12.2.15 represent a significant attack surface given their widespread deployment in enterprise environments. The vulnerability's classification as easily exploitable indicates that attackers with minimal privileges and network connectivity can leverage this weakness to gain substantial unauthorized access to critical business data.
The technical flaw manifests as a security bypass or authentication bypass vulnerability within the Internal Operations component that governs how the system processes requests from external sources. Attackers with low privileged accounts can utilize HTTP network access to manipulate system behavior and potentially gain unauthorized modification capabilities for critical data elements. This weakness specifically enables attackers to perform unauthorized creation, deletion, or modification operations against Oracle Landed Cost Management data stores. The vulnerability's CVSS 3.1 base score of 8.1 reflects the high severity impact on both confidentiality and integrity aspects of the information security triad.
The operational impact of this vulnerability extends far beyond simple data compromise, as it enables attackers to access complete sets of financial and operational data that organizations rely upon for import cost tracking and business decision-making. Successful exploitation could result in unauthorized modification of critical cost calculations, potentially leading to significant financial discrepancies and regulatory compliance issues. Organizations using Oracle E-Business Suite may experience data integrity breaches that affect supply chain operations, tax reporting, and financial auditing processes. The vulnerability's network accessibility means that attackers do not require physical presence or elevated privileges to exploit the weakness.
Security mitigations should prioritize immediate patch application for affected Oracle E-Business Suite versions, as this represents the most effective defense against exploitation. Organizations should implement network segmentation to limit access to Oracle Landed Cost Management systems and establish robust monitoring of HTTP traffic patterns for suspicious activities. The vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in remote services. Administrators should also consider implementing additional access controls and privilege management policies to reduce the potential impact of credential compromise. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in related Oracle E-Business Suite components that may present analogous attack vectors.