This vulnerability affects Oracle E-Business Tax versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle E-Business Tax. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm the patch availability or remediation level for this specific vulnerability. Users should verify patch availability and apply updates promptly to mitigate risk.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle E-Business Tax. This includes the ability to create, delete, or modify sensitive data, potentially compromising the confidentiality and integrity of the system's data. There is no reported impact on system availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is applied, restrict network access to Oracle E-Business Tax HTTP interfaces to trusted users only and monitor for unusual activity related to data modification.