Oracle iSupport CVE-2026-60826

Exploitation requires the attacker to possess high-privilege credentials (PR:H) on the Oracle E-Business Suite platform with network access to the Oracle iSupport application via HTTP - ruling out unauthenticated or low-privilege exploitation entirely. The high attack complexity (AC:H) indicates that exploitation is not straightforward and likely depends on specific system state, timing conditions, or a multi-step exploitation sequence beyond simple request crafting. The vulnerability is scoped to the Internal Operations component of Oracle iSupport specifically; other EBS components are not stated as affected. Limiting factors include: mandatory high-privilege credential possession prior to exploitation, non-trivial attack complexity reducing reliable exploit reproduction, and the limited version range (12.2.3-12.2.15) excluding older or future releases.

Real-world risk is moderate despite the full CIA impact (C:H/I:H/A:H). The CVSS 3.1 score of 6.6 accurately reflects two significant exploitation barriers: the attacker must already hold high privileges (PR:H) and overcome high attack complexity (AC:H), making opportunistic or unauthenticated exploitation infeasible. No EPSS score was provided in the available data, and no active exploitation (KEV) or publicly available proof-of-concept code has been identified, further constraining near-term risk. The primary realistic risk scenario involves an insider threat, a compromised administrative account, or a chained attack where an initial lower-severity flaw is used to elevate to the required privilege level before triggering this vulnerability. For organizations running Oracle EBS in environments with many privileged operators, this warrants inclusion in the next patch cycle rather than emergency response. The absence of a CWE classification is a gap - defenders cannot determine whether the root cause is a logic flaw, memory corruption, or injection class, which limits targeted compensating control selection.

A threat actor who has obtained high-privileged Oracle EBS credentials - through phishing, credential stuffing, or a prior compromise - connects to Oracle iSupport over HTTP and targets the Internal Operations component. Due to the high attack complexity, the attacker likely must satisfy specific preconditions such as a particular application state, timing window, or multi-step manipulation sequence before the exploit succeeds reliably. Upon successful exploitation, the attacker achieves full takeover of the iSupport application, gaining read/write control over sensitive customer service data and disrupting availability.