Oracle iSupport CVE-2026-60825

Exploitation requires the attacker to hold high-privilege credentials on the Oracle iSupport application (PR:H per CVSS vector), making unauthenticated exploitation impossible. Network access via HTTP to the Oracle iSupport Internal Operations component is also required (AV:N). The high attack complexity (AC:H) indicates that conditions beyond the attacker's direct control must be met - these specific conditions are not enumerated in the available description or references, which is a gap in the intelligence. Exploitation is bounded by: (1) mandatory high-privilege account access, restricting the threat to administrators, privileged insiders, or actors who have previously compromised such credentials; (2) the AC:H constraint, which likely implies a race condition, specific configuration state, or other environmental prerequisite. No user interaction is required (UI:N), and scope is unchanged (S:U), meaning impact is contained to the iSupport instance.

The CVSS 3.1 score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) captures a paradox common in Oracle CPU advisories: catastrophic impact potential (full system takeover) gated by restrictive preconditions. Attack complexity is high (AC:H) and privilege requirements are high (PR:H), which together reduce the realistic threat population to insiders, compromised administrator accounts, or sophisticated adversaries who have already established a foothold. EPSS data is not included in the provided intelligence and cannot be assessed. The vulnerability is absent from CISA KEV and no public proof-of-concept has been identified. The 'Information Disclosure' tag in the EUVD record is inconsistent with the full-takeover description - this likely reflects an incomplete tag rather than a contradicting impact claim, but it warrants verification against the Oracle CPU advisory. Real-world priority is moderate: organizations with Oracle EBS deployments should patch per the CPU cycle, but the PR:H and AC:H gates significantly reduce urgency compared to unauthenticated, low-complexity vulnerabilities.

An attacker in possession of high-privilege Oracle iSupport credentials - whether through insider access, credential theft, or prior compromise - sends a specially crafted HTTP request targeting the Internal Operations component under conditions that satisfy the high attack complexity requirement (such as a specific application state or timing window). If successful, the attacker achieves full takeover of the Oracle iSupport instance, gaining read and write access to sensitive support data and the ability to disrupt availability. No public proof-of-concept code exists, and the AC:H requirement suggests this is not a trivially repeatable exploit.