CVE-2026-70806

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle E-Business Tax

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax executes to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle E-Business Tax. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70806

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	e-business_tax	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle E-Business Tax within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with local access can exploit it to compromise the tax component. Successful exploitation may allow unauthorized data creation, deletion, or modification, as well as causing system crashes or hangs.

Detection Guidance

Detection requires checking for unauthorized modifications to Oracle E-Business Tax data or system crashes. Monitor logs for unusual activity in the Oracle E-Business Tax component. Verify file integrity of critical Oracle E-Business Tax files and database records. Check for repeated crashes or hangs in the Oracle E-Business Tax service.

Impact Analysis

If you use Oracle E-Business Tax versions 12.2.3-12.2.15, an attacker with local access could alter tax data, delete records, or crash the system. This could lead to financial discrepancies, incorrect tax calculations, or service disruptions affecting business operations.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modification or deletion of critical tax data. For GDPR, it risks data integrity and availability. For HIPAA, it may affect protected financial records. Organizations must ensure data integrity and availability to meet these standards.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for versions 12.2.3-12.2.15 to address the vulnerability in Oracle E-Business Tax. Ensure only authorized users have logon access to the infrastructure where Oracle E-Business Tax executes.

Hi! I’m here to help you understand CVE-2026-70806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70