Description
Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle E‑Business Tax includes an improperly enforced access control that permits a low‑privileged network attacker to issue HTTP requests to internal operation endpoints. Once accessed, the attacker can create, delete or modify critical records and may read all data exposed by the product. This flaw directly leads to confidentiality and integrity violations and is classified as CWE‑284.

Affected Systems

Version 12.2.3 through 12.2.15 of Oracle E‑Business Tax in the Oracle E‑Business Suite are affected. The vulnerability is reachable over the public network via standard HTTP and does not require elevated privileges or special authentication.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates high severity due to complete confidentiality and integrity impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can leverage the missing authorization checks by sending crafted HTTP requests, meaning the condition for exploitation is network access to the service and a user with low‑privilege credentials.

Generated by OpenCVE AI on August 4, 2026 at 02:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for Oracle E‑Business Tax versions 12.2.3–12.2.15 to eliminate the unauthorized access path.
  • Restrict HTTP traffic to E‑Business Tax internal operation endpoints using firewall rules or network segmentation so that only trusted administrative hosts can reach the service.
  • Implement or reinforce role‑based access controls in the application to ensure that only authorized users can perform create, delete, or modify actions on critical data.

Generated by OpenCVE AI on August 4, 2026 at 02:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access to Oracle E‑Business Tax via Improper Access Control

Sun, 02 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Data Manipulation in Oracle E‑Business Tax via Improper Access Control

Thu, 30 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Data Manipulation in Oracle E‑Business Tax via Improper Access Control

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Low‑Privilege HTTP in Oracle E‑Business Tax

Sat, 25 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Low‑Privilege HTTP in Oracle E‑Business Tax
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle e-business Tax
CPEs cpe:2.3:a:oracle:e-business_tax:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle e-business Tax
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle E-business Suite E-business Tax
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:22:27.397Z

Reserved: 2026-07-08T15:51:55.605Z

Link: CVE-2026-60974

cve-icon Vulnrichment

Updated: 2026-07-24T15:22:16.777Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:31.000

Modified: 2026-07-31T19:36:07.290

Link: CVE-2026-60974

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:15:04Z

Weaknesses