Oracle iSupplier Portal CVE-2026-101836

Requires a valid low-privileged account on Oracle E-Business Suite iSupplier Portal (CVSS PR:L) with network HTTP access to the Internal Operations component; affected versions are 12.2.3 through 12.2.15. No user interaction is needed and attack complexity is low. The primary limiting factor is the authentication requirement - the attacker must first possess a low-privileged portal credential (such as a supplier account) - which meaningfully reduces exposure for deployments that restrict portal access to trusted, provisioned suppliers rather than allowing open self-registration or internet-wide reachability.

This is a medium-severity (CVSS 3.1 base 6.5) confidentiality-only flaw in Oracle E-Business Suite iSupplier Portal. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality impact (unauthorized read access to all iSupplier Portal data) with no integrity or availability impact. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag directly conflicts with the CVSS PR:L and the description's 'low privileged attacker' phrasing - authentication IS required, so this is NOT an authentication bypass; treat that tag as suspect. Net priority is moderate rather than urgent: it is patchable via the Oracle October 2026 CPU and requires a valid (if low-privileged) account, but Oracle EBS internet-facing portals have historically been attractive targets, so organizations exposing iSupplier Portal externally should prioritize patching above the raw 6.5 score.

An attacker holding any low-privileged iSupplier Portal account (e.g., a supplier login) sends crafted HTTP requests to the Internal Operations component and reads confidential data belonging to other suppliers or the operator, up to all iSupplier-accessible data. Low attack complexity and no required user interaction make the attack reliable once authenticated; no public exploit code is identified at time of analysis.