CVE-2026-60806: Oracle Cost Management RCE Vulnerability

CVE-2026-60806 Overview

CVE-2026-60806 affects the Oracle Cost Management product within Oracle E-Business Suite, specifically the Costing Transaction Errors component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can compromise Oracle Cost Management. Successful exploitation results in takeover of the Oracle Cost Management application, with impact to confidentiality, integrity, and availability.

Oracle published the fix in its July 2026 Critical Patch Update. The vulnerability requires authenticated access and is rated as difficult to exploit, but the impact scope is broad because it enables full compromise of the affected module.

Critical Impact
Authenticated network attackers can take over Oracle Cost Management, exposing financial costing data and disrupting supply chain and manufacturing operations across affected E-Business Suite deployments.

Affected Products

Oracle E-Business Suite — Oracle Cost Management, version 12.2.3
Oracle E-Business Suite — Oracle Cost Management, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Cost Management, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60806 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Fix delivered in the Oracle Critical Patch Update

Technical Details for CVE-2026-60806

Vulnerability Analysis

The flaw resides in the Costing Transaction Errors component of Oracle Cost Management. This component processes cost accounting transactions that fail initial validation and require reprocessing. An authenticated user with low privileges can send crafted HTTP requests that manipulate transaction error handling logic to escalate access within the module.

A successful attack results in full compromise of Oracle Cost Management, exposing item cost data, cost adjustments, inventory valuations, and manufacturing cost roll-ups. The attacker also gains the ability to modify or destroy costing data used for financial reporting.

Exploitation requires network access via HTTP to the E-Business Suite front end and valid user credentials, which limits opportunistic attacks but not insider or credential-theft scenarios.

Root Cause

Oracle has not published root cause details in the public advisory. Based on the affected component and impact profile, the vulnerability stems from insufficient authorization enforcement or input validation within transaction error handling code paths in Oracle Cost Management. Oracle addresses these issues under its coordinated disclosure policy without releasing exploit-level detail.

Attack Vector

The attack requires network access to the Oracle E-Business Suite web tier over HTTP. The attacker must hold a valid low-privileged application account. Attack complexity is described as high, meaning the attacker must satisfy specific conditions outside their control, such as timing, transaction state, or environment configuration, before the exploit succeeds. No user interaction is required, and the scope remains unchanged within the vulnerable module.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-60806 at the time of publication. The EPSS score is 0.345%.

Detection Methods for CVE-2026-60806

Indicators of Compromise

Unexpected HTTP POST or GET requests from low-privileged application users to Cost Management URLs handling costing transaction errors (paths under /OA_HTML/ referencing costing responsibilities).
Anomalous FND_LOGINS or FND_USER audit entries showing costing transaction access from users without a business need for cost accounting functions.
Unexplained modifications in MTL_MATERIAL_TRANSACTIONS, CST_COST_UPDATES, or costing error tables outside scheduled batch windows.

Detection Strategies

Baseline normal request patterns to Cost Management pages and alert on deviations in request frequency, parameters, or source IPs.
Correlate application-tier audit logs with database audit trails to identify low-privileged accounts triggering high-impact costing changes.
Monitor Oracle E-Business Suite Managed SQL logs for unusual queries or updates initiated through the Costing Transaction Errors workflow.

Monitoring Recommendations

Ingest Oracle E-Business Suite application and database audit logs into a centralized analytics platform for correlation with identity and network telemetry.
Track privilege changes and responsibility assignments in FND_USER_RESP_GROUPS for accounts granted access to Cost Management.
Alert on failed logins followed by successful authentication to costing responsibilities from the same source.

How to Mitigate CVE-2026-60806

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite 12.2 instances running Cost Management.
Inventory all E-Business Suite environments, including development and test, to identify affected 12.2.3–12.2.15 deployments.
Review and reduce user assignments to Cost Management responsibilities, enforcing least privilege.
Rotate credentials for any accounts with historical access to Cost Management if compromise is suspected.

Patch Information

Oracle released a fix as part of the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory - July 2026 for the patch identifier, prerequisites, and application instructions specific to your E-Business Suite release level.

Workarounds

Restrict network access to the E-Business Suite web tier to trusted corporate networks and VPN ranges until patches are applied.
Temporarily remove Cost Management responsibilities from non-essential users to shrink the exploitable user population.
Enable enhanced auditing on Cost Management pages and costing database objects to increase visibility while patching is scheduled.

bash

# Verify E-Business Suite patch level after applying the July 2026 CPU
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EOF