Oracle E-Business Tax EUVD-2026-47221

Requires a low-privileged authenticated account on the Oracle E-Business Suite application (CVSS PR:L) with HTTP network access to the EBS web tier hosting the E-Business Tax 'Internal Operations' component, on releases 12.2.3-12.2.15. Limiting factors: exploitation is not pre-authentication despite the 'Authentication Bypass' tag - the attacker must already possess valid low-level credentials or a session; no availability impact is possible (A:N); and the affected instance must be a supported 12.2.x deployment with E-Business Tax in use. No special non-default configuration or user interaction is otherwise needed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable network attack requiring only low privileges and no user interaction, yielding full read and write access to E-Business Tax data - a genuine 8.1 High. Real-world priority is elevated because EBS is a business-critical financial system holding sensitive tax and accounting data, and only a low-privileged foothold is needed. Countervailing signals: no EPSS score, no KEV listing, and no known public exploit code were provided, indicating no evidence of active or widespread exploitation yet. Note a conflict to verify: the 'Authentication Bypass' tag implies no authentication, yet the CVSS vector explicitly requires PR:L (an authenticated low-privileged account) - the CVSS metrics should govern here, so treat this as an authenticated authorization flaw unless Oracle states otherwise.

An attacker who has obtained or been granted any low-privilege EBS application account sends crafted HTTP requests to the E-Business Tax Internal Operations functionality and, by abusing the authorization weakness, reads and alters tax and financial data beyond their assigned permissions. No user interaction or elevated privileges are required, and low attack complexity means the request succeeds reliably; no public proof-of-concept has been identified at time of analysis.