What is the CVSS score of CVE-2026-61257?

CVE-2026-61257 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle iSupport CVE-2026-61257

EUVD-2026-47446 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6prx-r3xc-76m4

Authentication Bypass Oracle Isupport

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-exposed HTTP component requires a low-privileged authenticated session; no scope change, no availability impact, and partial data confidentiality and integrity loss only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:09 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Call Back). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.

Technical ContextAI

Oracle iSupport is a customer self-service portal module embedded within Oracle E-Business Suite (EBS), enabling end-users to log service requests, track orders, and interact with support workflows. The affected component is 'Call Back', a feature within iSupport that likely manages callback scheduling or request submission. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the component is exposed over HTTP with no complex preconditions. CWE is unassigned in this advisory, so the precise root cause class cannot be confirmed from NVD data; however, the 'Authentication Bypass' tag supplied by the reporter (Oracle PSIRT) strongly suggests an authorization control deficiency - where a low-privileged authenticated session can access or manipulate data records belonging to other users or protected data tiers. Affected CPE covers Oracle EBS iSupport versions 12.2.3 through 12.2.15, a wide range spanning several years of maintenance releases.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses this vulnerability per the official advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for EBS and must be applied following Oracle's patching instructions for the specific EBS version in use. An exact patched release version was not independently confirmed beyond the CPU reference - consult My Oracle Support (MOS) for patch numbers corresponding to your EBS version. As a compensating control pending patch application, consider restricting network access to the iSupport Call Back endpoint at the web application firewall or load balancer level, limiting access to known, trusted IP ranges; note this may impact customer self-service workflows. Monitoring iSupport access logs for anomalous low-privileged account activity - particularly bulk data reads or unexpected record modifications - can help detect exploitation attempts in the interim.