CVE-2026-60974 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle E-Business Tax versions 12.2.3-12.2.15 should prioritize patching this vulnerability. Low-privileged attackers with network access via HTTP can exploit this vulnerability, potentially leading to significant data compromise.

Technical summary

The CVE-2026-60974 vulnerability is in the Oracle E-Business Tax product of Oracle E-Business Suite, specifically in the Internal Operations component. Supported versions affected are 12.2.3-12.2.15. The vulnerability is easily exploitable and allows a low-privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle E-Business Tax accessible data, as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. The CVSS 3.1 Base Score is 8.1, with Confidentiality and Integrity impacts.

Defensive priority

Oracle E-Business Tax vulnerability allows low-privileged attackers with network access via HTTP to compromise the system, potentially leading to unauthorized data creation, deletion, or modification.

Recommended defensive actions

• Review and apply Oracle's security patches for E-Business Tax
• Restrict network access to E-Business Tax systems
• Monitor E-Business Tax logs for suspicious activity
• Implement compensating controls for data access and modification
• Conduct a thorough review of the affected systems to identify potential exposure
• Verify that all necessary security controls are in place to prevent exploitation
• Track and document all changes made to the system to ensure accountability

Evidence notes

The CVE-2026-60974 vulnerability affects Oracle E-Business Tax versions 12.2.3-12.2.15. It allows low-privileged attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle E-Business Tax accessible data, as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.