CVE-2026-60974: Oracle E-Business Tax Auth Bypass Flaw

CVE-2026-60974 Overview

CVE-2026-60974 is a high-severity vulnerability in the Oracle E-Business Tax product, part of the Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and grants read access to all Oracle E-Business Tax accessible data. Oracle disclosed the vulnerability in its July 2026 Critical Patch Update.

Critical Impact
An authenticated network attacker can read and modify all data accessible to Oracle E-Business Tax, undermining the confidentiality and integrity of tax records processed by the platform.

Affected Products

Oracle E-Business Suite — Oracle E-Business Tax component 12.2.3
Oracle E-Business Suite — Oracle E-Business Tax versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle E-Business Tax component 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60974 published to NVD as part of the Oracle July 2026 Security Alert
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60974

Vulnerability Analysis

CVE-2026-60974 affects the Internal Operations component of Oracle E-Business Tax within Oracle E-Business Suite. The vulnerability is network-exploitable over HTTP and requires only low privileges, meaning any authenticated application user can attempt the attack. No user interaction is required, and the attack complexity is low, which makes exploitation practical against exposed instances.

Successful exploitation impacts both confidentiality and integrity. An attacker gains complete read access to data accessible through the Oracle E-Business Tax module and can create, modify, or delete records. Availability is not impacted. Because the E-Business Tax module handles tax configuration, jurisdiction rules, and calculated tax data used across financial workflows, tampering can propagate into general ledger, receivables, and payables data.

The EPSS score at publication is 0.365%, placing the vulnerability at the 29th percentile for near-term exploitation probability. No public proof-of-concept, exploit code, or in-the-wild activity has been reported at the time of this writing.

Root Cause

Oracle has not published a detailed root-cause analysis in the public advisory. Based on the CVSS metrics and the affected component (Internal Operations), the flaw allows an authenticated low-privileged user to perform actions that should be restricted to administrators, which is consistent with a broken access control or authorization bypass pattern. Refer to the Oracle July 2026 Security Alert for the vendor's technical acknowledgement.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite web tier. The attacker must hold valid application credentials with low privileges. From that position, the adversary sends crafted requests to the vulnerable Internal Operations endpoint of the E-Business Tax module and either reads sensitive tax data or issues create, update, or delete operations against records outside their authorized scope.

No verified exploitation code is publicly available. Detailed request-level analysis should be sourced from the Oracle advisory once customers apply the July 2026 Critical Patch Update.

Detection Methods for CVE-2026-60974

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle E-Business Tax records performed by non-administrative user accounts.
HTTP requests to Oracle E-Business Suite Internal Operations endpoints originating from user sessions that do not normally access the tax module.
Audit log entries showing tax configuration or jurisdiction changes outside of scheduled change windows.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for the E-Business Tax responsibilities.
Baseline normal API and form access patterns per user role, then alert on deviations that touch Internal Operations functions.
Correlate database-level audit events on ZX_* tax schema tables with application-tier session identifiers to attribute unauthorized changes.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized analytics platform for retention and correlation.
Monitor for concurrent program executions and direct data manipulations against tax tables outside of approved integration accounts.
Alert on HTTP 200 responses to previously unseen URL patterns under /OA_HTML/ associated with the E-Business Tax module from low-privilege user sessions.

How to Mitigate CVE-2026-60974

Immediate Actions Required

Apply the fixes documented in the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15.
Inventory all internet-facing Oracle E-Business Suite instances and prioritize patching for systems exposed beyond the corporate network.
Audit user assignments for E-Business Tax responsibilities and remove accounts that no longer require access.

Patch Information

Oracle addressed CVE-2026-60974 in the July 2026 Critical Patch Update. Customers must download the relevant patch for Oracle E-Business Suite 12.2.x from My Oracle Support and apply it following the CPU installation instructions. Oracle recommends staying on actively supported versions to remain eligible for security updates.

Workarounds

Restrict network reachability of the Oracle E-Business Suite web tier to trusted networks and VPN clients until patching completes.
Apply Web Application Firewall rules to block anomalous requests to E-Business Tax Internal Operations URLs from non-administrative sessions.
Enforce least-privilege responsibility assignments so that only required users hold access to the Oracle E-Business Tax module.

bash

# Example: apply the Oracle E-Business Suite CPU patch with adop
adop phase=apply patches=<CPU_JUL2026_PATCH_ID> workers=8
adop phase=finalize,cutover,cleanup