CVE-2026-46941: Oracle Cost Management Auth Bypass Flaw

CVE-2026-46941 Overview

CVE-2026-46941 is a high-severity access control vulnerability [CWE-284] in the Cost Maintenance component of Oracle Cost Management, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this issue, though successful exploitation requires meeting specific conditions that make the attack difficult to execute. When exploited, the vulnerability results in full takeover of Oracle Cost Management, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation results in complete takeover of Oracle Cost Management, exposing sensitive financial cost data and allowing modification of costing records used across the E-Business Suite.

Affected Products

Oracle E-Business Suite — Oracle Cost Management 12.2.3
Oracle E-Business Suite — Oracle Cost Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Cost Management 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-46941 published to NVD as part of the Oracle Critical Patch Update - July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46941

Vulnerability Analysis

The vulnerability resides in the Cost Maintenance component of Oracle Cost Management. It is categorized as an Improper Access Control weakness [CWE-284]. An authenticated attacker holding low-level privileges can send crafted HTTP requests to trigger the flaw. Successful exploitation yields takeover of the Oracle Cost Management module, granting the attacker the ability to read, modify, and disrupt costing data.

The attack complexity is high, meaning the attacker must satisfy conditions outside their direct control, such as specific configuration states or timing constraints. No user interaction is required once those conditions are met. The scope remains unchanged, but confidentiality, integrity, and availability impacts are all high. EPSS currently rates the exploitation probability at 0.345%.

Root Cause

The underlying weakness is improper access control within the Cost Maintenance component. Authorization checks fail to properly restrict what low-privileged accounts can perform against protected resources exposed by the module. This allows a caller with limited entitlements to reach functionality reserved for higher-privileged roles.

Attack Vector

Exploitation is remote over the network via HTTP. The attacker must possess valid low-privilege credentials to the Oracle E-Business Suite instance. Once authenticated, the attacker issues HTTP requests to the Cost Maintenance endpoints that fail to enforce authorization. Refer to the Oracle Critical Patch Update - July 2026 for the vendor's technical description.

No public proof-of-concept code has been released, and no verified exploitation code is available. Oracle historically limits technical detail in its Critical Patch Update advisories.

Detection Methods for CVE-2026-46941

Indicators of Compromise

Unexpected modifications to cost records, item costs, or cost update history tables performed by accounts that do not normally hold Cost Manager responsibilities.
HTTP requests to Cost Management URLs from low-privileged user sessions accessing functions outside their assigned menu entries.
Sudden creation, update, or deletion of pending cost adjustments outside scheduled batch windows.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking, then baseline which responsibilities normally reach Cost Maintenance forms and flag deviations.
Correlate application-tier HTTP access logs with database audit trails on CST_* tables to identify writes not associated with authorized responsibilities.
Alert on privilege combinations where a low-privileged user account performs write operations against Cost Management APIs.

Monitoring Recommendations

Continuously monitor Oracle E-Business Suite middle-tier logs (FMW_HOME access logs) for anomalous request patterns targeting Cost Management endpoints.
Track changes to the FND_USER_RESP_GROUPS table to detect unauthorized responsibility assignments granting Cost Management access.
Forward E-Business Suite logs to a centralized SIEM and retain them for correlation with authentication events.

How to Mitigate CVE-2026-46941

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Cost Management versions 12.2.3 through 12.2.15.
Review and reduce assigned responsibilities for low-privileged user accounts, applying least-privilege principles to Cost Management access.
Rotate credentials for any account suspected of unauthorized Cost Management activity and audit recent Cost Maintenance transactions.

Patch Information

Oracle addressed CVE-2026-46941 in the Oracle Critical Patch Update - July 2026. Administrators should consult the advisory's Oracle E-Business Suite Risk Matrix for the specific patch identifiers matching their installed version and apply them through the standard adop patching workflow.

Workarounds

Restrict network access to the Oracle E-Business Suite middle tier so that only trusted internal networks and VPN clients can reach HTTP endpoints.
Remove Cost Management responsibilities from user accounts that do not require them until the patch is applied.
Place a web application firewall in front of the E-Business Suite front end and block anomalous request patterns targeting Cost Maintenance URLs.

bash

# Apply the Oracle E-Business Suite July 2026 CPU patch via adop
# Replace <patch_top> and <patch_number> with values from the CPU advisory
cd $PATCH_TOP/<patch_number>
adop phase=apply patches=<patch_number> workers=8
adop phase=finalize,cutover,cleanup