This vulnerability affects Oracle E-Business Tax within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker who has logon access to the infrastructure where Oracle E-Business Tax runs to compromise the application. Successful exploitation can result in unauthorized modification of critical data and cause a hang or frequent crashes, leading to a complete denial of service. The CVSS 3.1 base score is 7.1, reflecting high impact on integrity and availability with low attack vector and privileges required.

The vulnerability enables unauthorized creation, deletion, or modification of critical or all accessible data within Oracle E-Business Tax. Additionally, it allows an attacker to cause a hang or repeated crash of the application, resulting in a complete denial of service. There is no confidentiality impact reported. The attack requires low privileges but local access to the infrastructure.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.