This vulnerability affects Oracle E-Business Tax within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise Oracle E-Business Tax, leading to complete takeover of the product. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches and strongly recommends applying patches promptly to mitigate risk.

Successful exploitation allows an attacker with low privileges and logon access to the infrastructure to fully compromise Oracle E-Business Tax, resulting in complete takeover. This affects confidentiality, integrity, and availability of the product, potentially leading to unauthorized data access, modification, and service disruption.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches from the July 2026 CPU without delay. The vendor advisory does not indicate any temporary mitigations or that no action is required. Patch status is confirmed by the vendor advisory. Users should remain on actively supported versions and ensure timely patching to mitigate this vulnerability.