Oracle iSupport CVE-2026-61257

Exploitation requires a valid low-privileged account on the Oracle iSupport instance (PR:L confirmed by CVSS vector). The target system must be running Oracle iSupport versions 12.2.3 through 12.2.15 with the Call Back component enabled and network-accessible via HTTP. No user interaction from a victim is required (UI:N). No special non-default configuration is described as required beyond running an affected version with the Call Back feature active. Exploitation is limited by the need for at least a basic authenticated session - unauthenticated anonymous exploitation is not indicated by the PR:L vector. Impact is bounded to partial confidentiality and integrity of iSupport-accessible data only (S:U, C:L, I:L); no availability impact and no scope change to other systems are expected.

The CVSS 3.1 score of 5.4 Medium is consistent with an authenticated, non-destructive data exposure flaw: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The low attack complexity is concerning - once a low-privileged account is compromised or registered (iSupport is a customer-facing portal where account creation may be available to any customer), exploitation requires no further effort. The 'Authentication Bypass' tag introduces a nuance: despite PR:L indicating authentication is needed, the bypass may allow an authenticated user to exceed their data access scope, potentially reaching other users' support records or system data. No EPSS score is available to quantify automated exploitation probability. No KEV listing and no public POC mean this is not currently a crisis, but the wide affected version range (12.2.3-12.2.15), network accessibility, and low complexity make it a meaningful priority for organizations running Oracle EBS with iSupport enabled. Availability impact is confirmed as none (A:N). Risk is primarily data confidentiality and data integrity.

An attacker who has obtained or registered a low-privileged iSupport user account sends crafted HTTP requests to the Call Back component endpoint, exploiting an authorization bypass to access or modify support records, customer data, or callback entries belonging to other users. The low attack complexity means this can be scripted with minimal effort. No public exploit code has been identified, but the straightforward CVSS vector (AV:N/AC:L) means an attacker with basic web application skills and a valid low-privilege credential can attempt exploitation without specialized tooling.