CVE-2026-60972 in E-Business Tax
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Tax component of the Oracle E-Business Suite, specifically in the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial release range where this security flaw persists. The vulnerability classification as easily exploitable suggests that attackers require minimal prerequisites to leverage this weakness, making it particularly concerning for organizations running these supported releases.
The technical nature of this flaw manifests as a privilege escalation issue that operates through HTTP network access, meaning that an attacker positioned externally can exploit this weakness without requiring physical access to the system. This vulnerability allows a low-privileged user to achieve unauthorized access to sensitive data and operations within the Oracle E-Business Tax environment. The CVSS 3.1 base score of 8.1 indicates a high-severity vulnerability with significant impact on both confidentiality and integrity aspects of the security triad.
The operational impact of successful exploitation extends far beyond simple data theft, as attackers can achieve unauthorized creation, deletion, or modification of critical business data within the tax management system. This encompasses not just read access but also the ability to alter fundamental financial records that directly affect tax compliance and reporting accuracy. The potential for complete access to all Oracle E-Business Tax accessible data means that adversaries could manipulate the entire tax processing infrastructure, potentially leading to substantial financial losses and regulatory violations.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic privilege escalation scenario where insufficient authorization checks allow lower-privileged users to access restricted functionality. The ATT&CK framework would classify this under Privilege Escalation techniques, specifically focusing on the abuse of application permissions to gain elevated access rights. The network-based attack vector (AV:N) combined with low attack complexity (AC:L) and the requirement for only low privileges (PR:L) creates a particularly dangerous threat profile that can be leveraged by both internal and external attackers.
Organizations should prioritize immediate patching of affected Oracle E-Business Suite installations, as the vulnerability affects multiple versions within the 12.2.x release series. The suggested mitigations include implementing network segmentation to limit access to the affected application, enforcing strict authentication controls, and monitoring for unauthorized access attempts. Additionally, security teams should conduct comprehensive audits of user permissions and access controls within the Oracle E-Business Tax environment to identify any potential compromise. The vulnerability's impact on both confidentiality and integrity makes it critical for organizations to establish robust incident response procedures specifically designed to handle potential data manipulation scenarios in financial tax processing systems.