This vulnerability affects Oracle E-Business Tax versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the Oracle E-Business Tax application. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-269 (Improper Privilege Management). Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to complete compromise of Oracle E-Business Tax, impacting confidentiality, integrity, and availability of the application. This could allow an attacker to take over the Oracle E-Business Tax component, potentially affecting business-critical tax operations within Oracle E-Business Suite environments.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous security vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch or fix for CVE-2026-60973. Users of Oracle E-Business Tax versions 12.2.3 through 12.2.15 should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until a patch is confirmed and applied, restrict access to the infrastructure hosting Oracle E-Business Tax to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.