Oracle iSupplier Portal CVE-2026-60922

The attacker must possess a valid low-privileged account on the Oracle iSupplier Portal (PR:L per CVSS vector), such as a registered supplier user, with network reachability to the portal via HTTP. High attack complexity (AC:H) indicates that exploitation is not straightforward - specific application conditions, timing, or configuration states within the Internal Operations component must be met. The scope is unchanged (S:U), confining impact to data accessible within the iSupplier Portal itself. The 'Authentication Bypass' tag raises the possibility that the low-privileged account requirement may be circumventable, but this is not confirmed by the official CVSS PR:L assignment - security teams should treat PR:L as the baseline condition. There is no integrity or availability impact, and no user interaction required. Limiting factors: requires meeting AC:H conditions, restricted to confidentiality impact only, affects only a subset of portal data.

The CVSS 3.1 base score of 3.1 correctly signals a low-severity finding: while the attack vector is network (AV:N), exploitation requires high attack complexity (AC:H) and a low-privileged account (PR:L), with impact confined to limited confidentiality exposure and zero integrity or availability effects. The 'Authentication Bypass' intelligence tag introduces a notable discrepancy - if the vulnerability genuinely bypasses authentication, then PR:N might better reflect the risk and the real score could be higher; however, the official Oracle-assigned vector with PR:L is treated as authoritative absent vendor clarification. EPSS data is not provided, making probabilistic exploitation likelihood unavailable. There is no CISA KEV listing and no known POC, confirming no public or active exploitation. Real-world priority is low for most organizations, but Oracle EBS iSupplier Portal deployments often process sensitive third-party procurement data, so patching within the standard CPU cycle is still advisable. The AC:H constraint meaningfully limits opportunistic exploitation.

An attacker who holds or obtains a low-privileged Oracle iSupplier Portal supplier account constructs a crafted HTTP request targeting the Internal Operations component, exploiting specific application state or timing conditions required by the AC:H rating. Upon meeting the difficult exploitation prerequisites, the attacker reads a limited subset of portal data - potentially including purchase order details or other suppliers' procurement information - without authorization. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely in the near term.