Oracle E-Business Suite EUVD-2026-47220

The attacker must already possess a valid low-privilege logon to the infrastructure where Oracle E-Business Tax executes (CVSS PR:L, AV:L) - it is not exploitable by an unauthenticated remote attacker over the network. The affected deployment must run Oracle E-Business Suite E-Business Tax at a version between 12.2.3 and 12.2.15. Limiting factors: mandatory local access confines exploitation to users or attackers who have already obtained an account or foothold on the host; there is no user-interaction requirement (UI:N) and attack complexity is low (AC:L), so once local access exists, exploitation is straightforward.

The signals point to a moderately-high but access-gated risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) shows that once an attacker holds any low-privilege logon to the infrastructure, exploitation is easy (AC:L), needs no user interaction, and yields complete compromise of the module. The decisive mitigating factor is AV:L: this is not remotely exploitable by an anonymous network attacker, so mass internet-facing exploitation is unlikely. No EPSS score, SSVC decision, or POC indicator was provided, and the CVE is absent from CISA KEV, so there is no evidence of active or automatable exploitation - practical priority is high where many users hold host/application logons and lower where such access is tightly restricted. Oracle's own 'easily exploitable' phrasing aligns with AC:L and is credible as a vendor statement.

An attacker who already holds a low-privilege application or OS logon on a server running Oracle E-Business Tax leverages the flaw locally, with no user interaction, to escalate to full control of the module. From there they can read, alter, or destroy tax and financial data, breaking the confidentiality, integrity, and availability of E-Business Tax. No public proof-of-concept was identified at time of analysis.