What is the CVSS score of CVE-2026-46957?

CVE-2026-46957 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle iSupplier Portal are affected by CVE-2026-46957?

Oracle iSupplier Portal in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to account takeover by authenticated users, creating exposure to unauthorized access of supplier data, procurement…

How to fix or mitigate CVE-2026-46957?

Within 24 hours: (1) Identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 with iSupplier Portal enabled; (2) Implement firewall rules and network access restrictions to limit remote connectivity to the portal. Within 7 days: (1) Audit and disable unnecessary low-privileged accounts with portal access; (2) Enable enhanced logging on authentication and privilege-related events; (3) Contact Oracle support regarding patch availability and timeline. Within 30 days: (1) Execute upgrade plan to Oracle E-Business Suite versions outside the vulnerable range (versions prior to 12.2.3 or after 12.2.15); (2) If upgrade timeline extends beyond 30 days, deploy Web Application Firewall (WAF) with account takeover detection rules.

Oracle iSupplier Portal CVE-2026-46957

EUVD-2026-37268 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Isupplier Portal Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reach (AV:N), Oracle states difficult to exploit (AC:H), requires a supplier-level account (PR:L), no user interaction, and full takeover of the module yields C:H/I:H/A:H within unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:53 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle iSupplier Portal (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw is rated CVSS 7.5 with high confidentiality, integrity, and availability impact, but carries high attack complexity, suggesting non-trivial preconditions. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Technical ContextAI

Oracle iSupplier Portal is a self-service web application within Oracle E-Business Suite (CPE cpe:2.3:a:oracle_corporation:oracle_isupplier_portal) that lets external suppliers interact with buyers - submitting invoices, viewing purchase orders, managing shipments - over HTTP through the EBS middle tier. The affected component is 'Internal Operations,' which generally houses backend processing logic invoked from supplier-facing flows. No CWE was published by Oracle (typical for CPU entries), and the advisory withholds technical detail; the AV:N/AC:H/PR:L/C:H/I:H/A:H vector implies authenticated supplier-level interaction with a server-side flaw that, when triggered through a difficult-to-meet condition, yields full module compromise rather than a simple injection or auth-bypass.

RemediationAI

Apply the fixes from Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to all Oracle E-Business Suite 12.2 environments running iSupplier Portal between 12.2.3 and 12.2.15; Oracle's CPU is the authoritative source for exact patch identifiers and any prerequisite EBS/AD/TXK levels. Until patches are applied, restrict network exposure of the iSupplier Portal endpoint to known supplier networks via WAF or reverse-proxy IP allowlisting (trade-off: legitimate suppliers connecting from new IPs will be blocked), enforce MFA on supplier accounts to raise the cost of obtaining the PR:L foothold the vector requires, and review supplier account inventory to disable dormant or over-privileged accounts. Generic 'apply CPU' is the primary action - patch status: vendor-released patch via Oracle CPU June 2026 (specific version identifiers as published in the CPU matrix).