CVE-2026-60972: Oracle E-Business Tax Auth Bypass Flaw

CVE-2026-60972 Overview

CVE-2026-60972 is a high-severity vulnerability in the Oracle E-Business Tax product, part of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle E-Business Tax. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle E-Business Tax accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read and modify all Oracle E-Business Tax accessible data, threatening the confidentiality and integrity of enterprise tax records.

Affected Products

Oracle E-Business Suite - E-Business Tax version 12.2.3
Oracle E-Business Suite - E-Business Tax versions 12.2.4 through 12.2.14
Oracle E-Business Suite - E-Business Tax version 12.2.15

Discovery Timeline

2026-07-21 - CVE CVE-2026-60972 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-60972

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle E-Business Tax within Oracle E-Business Suite. An attacker requires only low privileges and network access via HTTP to exploit the flaw. No user interaction is needed, and the attack complexity is low. Successful exploitation impacts both confidentiality and integrity of all data accessible to Oracle E-Business Tax. Availability is not affected. The vulnerability carries an EPSS probability of 0.365% at the 29.037 percentile, indicating limited near-term exploitation likelihood.

Root Cause

Oracle has not published a public technical breakdown for this issue. Based on the advisory language, the flaw resides in server-side handling within the Internal Operations component of the E-Business Tax module. It permits an authenticated user to perform operations beyond their authorization boundary, indicating a broken access control or improper authorization condition in HTTP-exposed functionality.

Attack Vector

The attack originates over the network using HTTP against an Oracle E-Business Suite instance running an affected version of E-Business Tax. The attacker must hold a valid low-privileged account on the target system. Once authenticated, the attacker issues crafted HTTP requests to the Internal Operations component to read or modify tax data outside their permitted scope. Because Oracle E-Business Suite deployments are commonly exposed to internal networks and, in some cases, extranets, exploitation is feasible from any host with routing access to the application tier.

Oracle has not released public proof-of-concept code. Technical details are limited to the vendor advisory. See the Oracle July 2026 Security Alert for authoritative information.

Detection Methods for CVE-2026-60972

Indicators of Compromise

Anomalous HTTP requests to Oracle E-Business Tax URLs under /OA_HTML/ originating from low-privileged user sessions.
Unexpected INSERT, UPDATE, or DELETE activity in E-Business Tax schemas (ZX_* tables) by accounts without a business need.
Elevated volumes of tax data export or query activity outside of normal batch windows.

Detection Strategies

Review Oracle E-Business Suite FND audit logs and sign-on audit records for low-privileged accounts accessing Internal Operations functionality.
Correlate application-tier HTTP access logs with database change auditing on ZX_* tax schema objects to identify unauthorized modification patterns.
Baseline typical user access to E-Business Tax responsibilities and alert on deviations, particularly for accounts that recently gained network access to the application tier.

Monitoring Recommendations

Enable Oracle Database Fine-Grained Auditing on E-Business Tax tables to capture read and write activity per user.
Forward Oracle E-Business Suite application logs, WebLogic access logs, and database audit trails to a centralized SIEM for correlation.
Monitor authentication events for lateral privilege reuse where a compromised low-privileged account is used against multiple E-Business Suite modules.

How to Mitigate CVE-2026-60972

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all Oracle E-Business Suite environments running E-Business Tax versions 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite deployments and confirm patch status against the July 2026 CPU advisory.
Restrict network exposure of the Oracle E-Business Suite application tier to trusted management networks and VPN-authenticated users only.
Review and reduce the number of accounts with any responsibility that grants access to the E-Business Tax module.

Patch Information

Oracle addressed CVE-2026-60972 in the July 2026 Critical Patch Update. Administrators must apply the patch bundle referenced in the Oracle July 2026 Security Alert to all affected 12.2.x deployments. Oracle recommends applying Critical Patch Updates as soon as possible and validating fixes in a non-production environment before production rollout.

Workarounds

No official workaround has been published by Oracle. Patching is the required remediation path.
As a compensating control, place the E-Business Suite application tier behind a web application firewall and restrict HTTP access to the Internal Operations component to authorized administrative networks.
Enforce least-privilege review of Oracle E-Business Suite responsibilities to reduce the pool of accounts capable of authenticating to the affected component.

bash

# Verify installed Oracle E-Business Suite patch level
adop -status
sqlplus apps/<password> @$AD_TOP/sql/adutconf.sql

# Confirm application of the July 2026 CPU patches
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
FROM ad_bugs
WHERE bug_number IN ('<JUL2026_CPU_PATCH_ID>')
ORDER BY last_update_date DESC;
EOF