What is the CVSS score of CVE-2026-60973?

CVE-2026-60973 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60973?

Oracle E-Business Tax (versions 12.2.3-12.2.15) contains a local privilege escalation vulnerability allowing any user with host-level access to completely compromise the tax module, exposing…

How to fix or mitigate CVE-2026-60973?

Within 24 hours, inventory all user and service accounts with host-level access to E-Business Tax systems and document the business justification for each. Within 7 days, enforce least-privilege host access controls (disable unnecessary accounts, restrict SSH/console login to authorized staff only), enable OS-level audit logging for privilege escalation attempts, and require multi-factor authentication for administrative access. Within 30 days, deploy endpoint detection and response (EDR) or file integrity monitoring on E-Business Tax infrastructure to detect exploitation, establish baseline alerting for suspicious privilege escalation, and monitor Oracle security advisories for patch availability.

Oracle E-Business Suite CVE-2026-60973

EUVD-2026-47220 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-hwm5-8qqm-52fw

Privilege Escalation Oracle E Business Tax

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Description confirms a local logon is required (AV:L, PR:L) with easy exploitation (AC:L) and no user interaction (UI:N), and full module takeover justifies C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax executes to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Tax. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-driven takeover in Oracle E-Business Tax (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker who can log on to the host infrastructure fully compromise the E-Business Tax module. Oracle rates it CVSS 3.1 7.8 with complete confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit was identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle E-Business Suite is a large enterprise ERP/financials platform; the E-Business Tax module (component: Internal Operations) centralizes tax determination, calculation, and reporting across the suite's financial applications. The CVSS vector (AV:L) indicates the flaw is reached through the local infrastructure rather than the network, meaning the attacker leverages an existing foothold or account on a host where E-Business Tax executes. No CWE was assigned in the source data (CWE: N/A), so the precise root-cause class - e.g., improper authorization, injection, or insecure internal-operations handling - cannot be confirmed from the provided intelligence; Oracle's language ('takeover' with only low privileges required) is consistent with a privilege-escalation or authorization weakness inside the module.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; an exact standalone fix version was not included in the source data, so identify the specific patch for your 12.2.x level from the CPU matrix. Because exploitation requires a local logon, effective compensating controls until patching include tightly restricting and auditing interactive and application logon accounts on E-Business Tax hosts, enforcing least privilege for application and OS users, and monitoring for anomalous local activity by low-privilege accounts; the trade-off is operational overhead and possible disruption to legitimate batch or operations users if access is curtailed too aggressively. Given full CIA impact, prioritize patching hosts where many users hold logon rights.