This vulnerability affects Oracle E-Business Tax component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle E-Business Tax. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references the July 2026 Critical Patch Update which includes numerous patches across Oracle products but does not explicitly confirm patch availability or remediation status for this specific vulnerability in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle E-Business Tax, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive business data. Availability is not impacted according to the CVSS vector. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance and patch availability. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle E-Business Tax interfaces where possible and monitor for unusual activity related to this component.