Oracle iSupport CVE-2026-46944

Exploitation requires the attacker to already hold a high-privileged authenticated account in Oracle E-Business Suite / iSupport (CVSS PR:H), and network HTTP reachability to the iSupport web tier on a running EBS 12.2.3-12.2.15 instance with the Internal Operations component deployed. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once those prerequisites are met exploitation is straightforward. Limiting factors are therefore: the requirement for a high-privilege EBS credential, deployment of the iSupport module specifically (not all EBS customers license it), and exposure of the iSupport URL to the attacker's network position - internet-exposed iSupport portals materially increase risk, while internal-only deployments substantially reduce it.

Signals are mixed. CVSS 3.1 rates this 9.1 Critical driven by AV:N, AC:L, UI:N, S:C, and High C/I/A impact, but PR:H means the attacker must already hold high-privilege credentials inside iSupport/EBS - a meaningful real-world barrier. There is no CISA KEV listing, no published EPSS score, no POC reference, and only a single Oracle CPU advisory as a source, so this is best treated as a high-severity but not currently exploited issue. Practical priority should be elevated for organizations where EBS administrative or integration accounts are broadly delegated or where iSupport is internet-facing, because in those environments PR:H is easier to satisfy and the scope change makes lateral impact across EBS modules realistic. Note that CWE is N/A and no technical root-cause details are available - the 'takeover' language is Oracle's standard CPU phrasing and does not by itself confirm RCE versus privileged data/integrity compromise.

An attacker who has obtained or been granted a high-privileged Oracle EBS account (for example a compromised administrator, an over-privileged integration user, or a malicious insider) issues crafted HTTP requests to the iSupport Internal Operations endpoints from anywhere they can reach the EBS web tier. The vulnerable code executes the operation without sufficient isolation, giving full takeover of iSupport and - due to scope change - the ability to affect other Oracle EBS modules sharing the same application context. No public exploit code is identified at time of analysis.