Oracle E-Business Tax CVE-2026-70806

Exploitation requires an authenticated session with at least low-level privilege on the local operating system or application layer of the infrastructure host where Oracle E-Business Tax executes (CVSS PR:L, AV:L). The attacker must have interactive or programmatic logon access to that server - remote unauthenticated attackers cannot exploit this directly over the network. No special application configuration, specific feature enablement, or non-default deployment mode is identified as a prerequisite beyond having a valid low-privileged local account. Exploitation is limited to Oracle E-Business Suite versions 12.2.3 through 12.2.15; installations outside this range are not confirmed affected. The scope-unchanged designation means impact is bounded to Oracle E-Business Tax itself and does not cascade to other systems by default.

The CVSS 3.1 base score of 7.1 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects a locally-exploitable flaw requiring only low privileges and no user interaction, with high integrity and availability impact but no confidentiality exposure. This profile is consistent with a malicious or compromised low-privileged OS or application account on the ERP server - a realistic insider threat or post-compromise lateral movement scenario in enterprise environments. The low attack complexity means even a mid-sized municipal IT team in olsztyn managing an Oracle E-Business Suite deployment should treat this as urgent remediation once October or August CPU patches are applied, given insider risk cannot be discounted in shared infrastructure. EPSS data is not available in the provided intelligence, limiting probabilistic exploitation forecasting; the absence of KEV listing and public POC code suggests opportunistic exploitation is not currently observed, though the easily exploitable rating increases the likelihood that exploitation would be straightforward if an attacker achieves local access. The scope-unchanged designation confirms blast radius is limited to the Oracle E-Business Tax application itself, which moderates enterprise-wide risk but still represents a severe impact on financial and tax data integrity.

An attacker who has obtained low-privileged local access to the server running Oracle E-Business Tax - whether via a compromised application service account, insider access, or post-breach lateral movement - interacts directly with the Internal Operations component to submit malformed or unauthorized requests. This results in unauthorized modification or deletion of critical tax records, or a repeatable application crash that denies service to legitimate business users. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity indicates that exploitation would not require advanced tooling once local access is established.