Oracle iSupport CVE-2026-60824

Exploitation requires network access to the Oracle iSupport web portal over HTTP and a low-privilege authenticated position (CVSS PR:L) on an affected EBS instance running iSupport 12.2.3-12.2.15 with the Internal Operations component in use. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an account exists the attack is repeatable and reliable. Limiting factors: the attacker must first obtain some valid low-privilege credential (the practical bar depends on whether the deployment permits self-registration or guest accounts - the 'Authentication Bypass' vendor tag suggests this bar may be low, which should be confirmed against the Oracle advisory), the iSupport module must be deployed and network-reachable, and impact is confined to confidentiality (no data modification or service disruption). Internet-facing iSupport portals are materially more exposed than internal-only deployments.

The signals are moderately but not maximally alarming. CVSS 3.1 is 7.7 (High) with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - network reachable, low complexity, no user interaction, but requiring some authenticated privilege (PR:L), and impacting confidentiality only. Oracle describes it as 'easily exploitable,' consistent with AC:L. There is no EPSS score, no POC, and no CISA KEV entry in the provided data, so real-world exploitation probability cannot be quantified and no active exploitation is confirmed. The elevated score is driven largely by the scope change plus high confidentiality impact rather than by full-system compromise (I and A are None). Note a mild tension worth verifying: PR:L requires the attacker to already hold a low-privilege iSupport account, yet the 'Authentication Bypass' tag could imply weaker preconditions - verify with the Oracle advisory whether a self-registered or guest-level account suffices. Overall this is a credible priority for organizations running EBS iSupport with external-facing portals, but absent KEV/POC/EPSS it is a patch-on-cycle rather than emergency-zero-day situation.

An attacker who holds or self-registers a low-privilege iSupport account sends crafted HTTP requests to the portal's Internal Operations endpoints and, through the authorization flaw, reads support data and other confidential records they are not entitled to, potentially reaching data owned by other EBS products via the scope change. Given AV:N/AC:L and no required user interaction, the request sequence is straightforward once portal access exists; however, no public POC was identified at time of analysis.