Description

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax executes to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle E-Business Tax. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:34.960Z",
  "pubdate": "2026-08-18T21:17:34.960Z",
  "executiveSummary": "A security vulnerability affecting the Oracle E-Business Tax product within Oracle E-Business Suite allows low-privileged authenticated attackers to compromise the integrity and availability of the application. Specifically impacting the Internal Operations component across supported versions 12.2.3 through 12.2.15, the flaw exposes critical data assets to unauthorized manipulation and introduces severe denial-of-service vectors. Exploitation requires local access to the underlying infrastructure where the affected software executes, alongside low privileges and valid logon credentials. Although confidentiality remains unimpacted, successful exploitation grants the adversary capabilities to execute unauthorized creation, deletion, or modification of critical data, as well as induce application hangs or repeatable system crashes, yielding a CVSS 3.1 base score of 7.1 with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Organizations deploying vulnerable iterations of Oracle E-Business Suite face heightened risk regarding operational continuity and transactional data integrity, necessitating prioritized remediation through official vendor patches and infrastructure hardening.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle E-Business Tax, a core module of Oracle E-Business Suite supporting versions 12.2.3 through 12.2.15. The root cause stems from insufficient access controls and inadequate authorization enforcement within internal routines processed by the application infrastructure. Attackers targeting this flaw must first achieve local interactive or programmatic access to the host operating system or infrastructure tier where Oracle E-Business Tax executes, combined with low-privileged user credentials capable of interacting with the local application environment. Because the attack vector is local (AV:L) with low complexity (AC:L) and requires no user interaction (UI:N), an authenticated low-privileged user can leverage locally exposed interfaces, APIs, or execution contexts to interface directly with vulnerable Internal Operations procedures. The attack flow proceeds as follows: First, the attacker establishes a valid local session on the target infrastructure hosting the Oracle E-Business Suite deployment. Second, utilizing low-privileged credentials, the attacker interacts with the vulnerable Internal Operations component of Oracle E-Business Tax, bypassing intended authorization checks due to flawed privilege validation logic. Third, the attacker supplies specially crafted inputs or initiates unauthorized transactional routines designed to manipulate underlying data structures or exhaust application execution threads. Post-exploitation impacts manifest in two primary vectors concerning Integrity and Availability: regarding Integrity, the attacker achieves unauthorized write, modification, and deletion privileges over critical database tables or accessible data elements managed by Oracle E-Business Tax, potentially corrupting financial records or operational parameters; regarding Availability, the execution of crafted payloads triggers unhandled exceptions, resource exhaustion, or infinite execution loops, resulting in an application hang or a frequently repeatable complete denial-of-service crash affecting the stability of the Oracle E-Business Tax ecosystem. Scope remains unchanged (S:U), confining the direct impact to the vulnerable component and its associated data repository without directly compromising the broader host kernel, though the cascading operational disruption remains critical."
}