Oracle iSupplier Portal CVE-2026-46894

Attacker must already hold a low-privileged authenticated account on the iSupplier Portal (PR:L) and reach the Home Page component over HTTPS on Oracle E-Business Suite 12.2.3-12.2.15; the iSupplier Portal module must be deployed and enabled (it is optional within EBS). Exploitation additionally requires interaction from a second, distinct user (UI:R) - typically an internal buyer, approver, or administrator who visits or renders supplier-controlled content on the Home Page - so portals where internal users never view supplier-supplied content, or where the iSupplier module is not enabled, are not exploitable. Deployments outside the 12.2.3-12.2.15 range or on EBS 12.1.x are not in scope per Oracle's affected-version statement.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) reflects a network-reachable, low-complexity flaw that only requires a registered low-privilege supplier account plus interaction from a second user - a realistic precondition in any production EBS deployment that onboards external suppliers. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is not provided, so widespread mass exploitation is unlikely in the near term; however, EBS environments are high-value targets for financial fraud and supply-chain manipulation, so targeted abuse by suppliers or attackers who phish supplier credentials is plausible. The signals are internally consistent: Oracle's own scoring, the EUVD listing, and the requirement for UI:R all point to a credible but not wormable threat, making this a high priority for any internet-exposed iSupplier deployment but not an emergency for portals restricted to vetted suppliers.

An attacker registers or compromises a low-privileged supplier account, then plants malicious content (likely script or crafted markup) in a field rendered on the iSupplier Home Page. When an internal buyer, approver, or administrator opens the page in their authenticated browser session, the payload executes in their context and is used to hijack the session or perform privileged actions, resulting in full takeover of the iSupplier Portal. No public exploit identified at time of analysis, so an attacker would currently need to develop the payload from the advisory and product knowledge.