This vulnerability in Oracle E-Business Tax allows an attacker with low privileges and network access via HTTP to gain unauthorized access that can lead to creation, deletion, or modification of critical data within Oracle E-Business Tax. The affected versions are 12.2.3 through 12.2.15. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions a large number of patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle E-Business Tax. Confidentiality and integrity of the data are highly impacted, but availability is not affected. This could compromise sensitive business and financial information managed by Oracle E-Business Tax.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle E-Business Tax interfaces to trusted users only and monitor for unusual activity related to data modification.