What is the CVSS score of CVE-2026-60974?

CVE-2026-60974 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Tax are affected by CVE-2026-60974?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical flaw in the Tax module that allows low-privileged users with network access to read, create, delete, or modify all…

How to fix or mitigate CVE-2026-60974?

Within 24 hours, identify all Oracle E-Business Suite systems running versions 12.2.3 through 12.2.15 and assess network exposure to ensure systems are not accessible to low-privilege accounts. Within 7 days, apply the July 2026 Critical Patch Update to all affected EBS instances-this patch is available from Oracle and fully remediates the vulnerability. Within 30 days, audit Tax module access logs covering the period since initial deployment to identify suspicious data access activity, and validate through testing that the patch has been successfully deployed across all production, staging, and development systems.

Oracle E-Business Tax CVE-2026-60974

EUVD-2026-47221 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g922-26m8-jxmh

Authentication Bypass Oracle E Business Tax

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with a low-privileged account and no user interaction (PR:L, AV:N, AC:L, UI:N); full read/write to module data gives C:H/I:H, and no availability impact means A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Sensitive data compromise in Oracle E-Business Tax (component: Internal Operations), part of Oracle E-Business Suite releases 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the E-Business Tax module. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and it is remediated in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle E-Business Tax is the tax-determination and reporting engine within Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, exposed through the standard EBS web tier over HTTP/HTTPS. The affected 'Internal Operations' component handles back-office tax processing logic accessible to authenticated application users. No CWE was assigned by NVD, so the precise root-cause class is unconfirmed; however, the reporter tag 'Authentication Bypass' combined with a CVSS vector requiring low privileges (PR:L) suggests a horizontal/vertical access-control or authorization weakness that lets an already-authenticated low-privilege account reach data it should not, rather than a fully pre-authentication bypass. The scope is Unchanged (S:U), meaning impact is confined to the E-Business Tax module's own data domain.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; no discrete fix version string was provided beyond the CPU, so consult the CPU patch matrix for the exact patch for your 12.2.x level). Because exploitation requires only a low-privileged authenticated account, interim compensating controls until patching include tightening application-user provisioning and removing unnecessary E-Business Tax responsibilities/roles, restricting network reachability of the EBS web tier to trusted networks or VPN, and enabling enhanced auditing/monitoring on tax-related data changes to detect abuse - with the trade-off that network restrictions may impede legitimate remote users and aggressive role removal can disrupt business tax workflows. Prioritize patching over workarounds since access-control flaws are difficult to fully mitigate without the vendor fix.