{"id":"CVE-2026-101567","published":"2026-10-20T22:18:08.693","lastModified":"2026-10-24T04:18:12.093","description":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Cost Management allows a low-privileged attacker with network access via HTTP to compromise the application, leading to full system takeover due to insufficient input validation or access controls in the Cost Planning component.","exploitability":"Easily exploitable by a low-privileged attacker with network access via HTTP; no user interaction required.","blast_radius":"Successful exploitation results in complete compromise of Oracle Cost Management, enabling unauthorized access to sensitive data, modification of system behavior, and potential disruption of operations.","remediation":"Upgrade Oracle E-Business Suite Cost Management to version 12.2.16 or later, as this is the first supported version beyond the affected range (12.2.3–12.2.15).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web-app","privilege-escalation","oracle-ebusiness","cost-planning"],"model":"garnet-coder","analyzedAt":"2026-10-26T09:05:28.106Z"}}