CVE-2026-60805: Oracle Cost Management Privilege Escalation

CVE-2026-60805 Overview

CVE-2026-60805 affects the Oracle Cost Management product within Oracle E-Business Suite, specifically the Cost Planning component. Supported versions 12.2.3 through 12.2.15 are affected. The vulnerability allows a high-privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized read access to all Oracle Cost Management data, and partial denial of service. Oracle addressed this issue in the Oracle Critical Patch Update for July 2026.

Critical Impact
Authenticated attackers with high privileges can read, modify, or delete all Oracle Cost Management accessible data over HTTP and induce a partial denial of service.

Affected Products

Oracle E-Business Suite — Oracle Cost Management (Cost Planning component)
Supported versions 12.2.3 through 12.2.15
Deployments exposing Oracle Cost Management HTTP interfaces to network access

Discovery Timeline

2026-07-21 - CVE-2026-60805 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle released fix in the Critical Patch Update (cpujul2026)

Technical Details for CVE-2026-60805

Vulnerability Analysis

The flaw resides in the Cost Planning component of Oracle Cost Management, a module of Oracle E-Business Suite. Oracle classifies the issue as difficult to exploit and requiring high privileges, meaning an attacker must already hold an elevated authenticated session within the E-Business Suite environment. Once those conditions are met, the attacker can reach the vulnerable code path over HTTP without user interaction. The impact spans confidentiality, integrity, and availability: attackers can read all data accessible to Cost Management, alter or delete records, and trigger a partial denial of service against the module. The EPSS probability is 0.315% at the 23.696 percentile as of 2026-07-23, indicating a low near-term exploitation forecast, though privileged insider abuse remains a realistic threat model for enterprise resource planning (ERP) systems.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-60805. The advisory categorizes the defect within the Cost Planning component and confirms authenticated network-based abuse leads to high impact on confidentiality and integrity. Consult the Oracle Critical Patch Update advisory for the definitive technical scope.

Attack Vector

The attack path is network-based over HTTP against the Oracle Cost Management application interface. The attacker must authenticate with high privileges within Oracle E-Business Suite before invoking the vulnerable Cost Planning functionality. No end-user interaction is required, and the scope is unchanged, so impact is confined to the vulnerable component. The high attack complexity indicates that specific preconditions or timing must be satisfied for reliable exploitation.

No verified exploitation code is publicly available for CVE-2026-60805.
Refer to the Oracle Critical Patch Update for July 2026 for technical guidance.

Detection Methods for CVE-2026-60805

Indicators of Compromise

Unexpected HTTP requests to Oracle Cost Management Cost Planning endpoints originating from high-privileged accounts outside normal business workflows
Anomalous create, update, or delete operations against cost planning tables and records
Partial availability degradation or errors within the Oracle Cost Management module correlated with authenticated sessions

Detection Strategies

Audit Oracle E-Business Suite application logs for high-privileged user activity against Cost Planning URLs and forms
Correlate database audit trails for unauthorized DML statements touching Cost Management schemas
Baseline legitimate administrative workflows so deviations by privileged accounts are flagged for review

Monitoring Recommendations

Enable and centralize Oracle E-Business Suite Sign-On Audit and page access tracking for the Cost Management responsibility
Forward application, web tier, and database audit logs to a centralized analytics platform for correlation and retention
Alert on privileged session anomalies such as off-hours access, new source IP addresses, or bursts of Cost Planning transactions

How to Mitigate CVE-2026-60805

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2.3–12.2.15 environments
Inventory privileged accounts with access to the Oracle Cost Management responsibility and revoke unnecessary grants
Restrict network reachability of the E-Business Suite web tier to trusted management networks and VPN users

Patch Information

Oracle delivered the fix in the Oracle Critical Patch Update - July 2026. Administrators should follow Oracle's patch application guide for E-Business Suite 12.2, apply required technology stack updates, and validate Cost Management functionality after deployment in a test environment before promoting to production.

Workarounds

Remove the Cost Management responsibility from users who do not require it until patching is complete
Enforce multi-factor authentication (MFA) on all privileged E-Business Suite accounts to reduce the risk of credential misuse
Place a reverse proxy or web application firewall (WAF) in front of the E-Business Suite web tier to log and rate-limit access to Cost Planning URLs

bash

# Example: restrict web tier access to trusted subnets via iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP