Oracle iSupport CVE-2026-60827

Exploitation requires human interaction from a person other than the attacker (UI:R) - a victim who is an iSupport user must open a malicious link or view attacker-supplied content served through or reflected by the iSupport web interface; the attacker needs no authentication and only HTTP network reachability to the iSupport application. The scope change means the impact is realized in the victim's session and can extend to additional Oracle EBS products the victim can access. Limiting factors: the attack cannot succeed without a targeted user taking an action, it affects only Oracle EBS 12.2.3-12.2.15 deployments with the iSupport component enabled and internet- or attacker-reachable, and it yields integrity impact only (no data disclosure and no service disruption on its own).

The signals are mixed and point to a genuine but conditional risk rather than a drop-everything emergency. CVSS 3.1 rates it 7.4 (High) driven by network reach, low attack complexity, no authentication, and a scope change into other EBS products - but the integrity-only impact (no confidentiality, no availability) and the mandatory human interaction (UI:R) meaningfully constrain real-world exploitation. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV means there is no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the description, which describes data-integrity manipulation via a tricked victim, not credential circumvention - verify with Oracle before treating this as an auth-bypass. Net: prioritize patching in Oracle EBS environments given the scope change, but the interaction requirement makes mass automated exploitation unlikely.

An attacker crafts a malicious link or content payload targeting the Oracle iSupport application and lures an authenticated iSupport user (for example a support agent or customer) into clicking or viewing it. When the victim interacts, the injected content executes in their session context and creates, alters, or deletes critical data - and because of the scope change, the effect can extend into other Oracle EBS modules the victim can reach. No public exploit code was identified at time of analysis.