Vulnerability in Cost Management Software from Oracle E-Business Suite
CVE-2026-46940

8.8HIGH

Key Information:

Vendor

Oracle
Status
Oracle Cost Management
Vendor
CVE Published:
16 June 2026

What is CVE-2026-46940?

An improper access control vulnerability exists in Oracle Cost Management, part of the Oracle E-Business Suite, affecting versions from 12.2.3 to 12.2.15. This security flaw can be exploited by an attacker with low privileges who has network access via HTTP, potentially leading to a complete takeover of the Cost Management application. The issue highlights the importance of applying security patches to mitigate risks associated with unauthorized access.

Affected Version(s)

Oracle Cost Management 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cspujun2026.html
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.