Oracle iSupplier Portal CVE-2026-60919

Exploitation requires unauthenticated HTTP network access to Oracle iSupplier Portal (versions 12.2.3-12.2.15) and the ability to target the Internal Operations component specifically. The CVSS AC:H metric indicates that beyond network reachability, the attacker must meet additional preconditions - the advisory does not enumerate these explicitly, but they likely involve specific request parameters, server-side state, or internal endpoint path knowledge. No user interaction or attacker authentication is required. Limiting factors include: (1) the AC:H constraint makes opportunistic, automated scanning unlikely to succeed; (2) impact is read-only and partial, not full data exfiltration; (3) organizations with iSupplier Portal deployed behind a VPN, internal network, or reverse proxy enforcing pre-authentication would significantly reduce attacker reach. Versions prior to 12.2.3 and post-patch (July 2026 CPU-applied) installations are not confirmed affected.

The CVSS 3.1 base score of 3.7 (Low) accurately reflects the constrained risk: AC:H substantially depresses opportunistic exploitation probability, and C:L limits damage to a partial read of portal data - no write capability, no service disruption. No EPSS score was provided in the available intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC has been reported. The Authentication Bypass tag warrants attention beyond the raw score because authentication bypass classes can sometimes be chained with other weaknesses; however, the vendor description constrains impact to 'a subset of accessible data.' For organizations running internet-facing EBS iSupplier Portal instances, the risk is modestly elevated given the supplier data sensitivity (financial, contractual), even at low CVSS. For internal-only deployments behind perimeter controls, risk is minimal. CVSS and real-world risk signals are consistent here - this is a genuine low-priority item, not a high-CVSS-inflated alert.

An unauthenticated attacker with HTTP network access to an exposed Oracle iSupplier Portal instance probes Internal Operations endpoints, leveraging knowledge of internal URL structures or timing-dependent conditions to bypass authentication checks. Due to AC:H, the attacker must satisfy specific preconditions - such as particular server-side state or precise request crafting - before the bypass succeeds. Upon success, the attacker reads a subset of portal data such as supplier records, purchase order metadata, or internal operational details without authorization. No public exploit code exists at time of analysis.