Oracle iSupport CVE-2026-91257

Exploitation requires an authenticated session on the Oracle E-Business Suite iSupport module (CVSS PR:L - a low-privileged account suffices) with network/HTTP reachability to the Service Requests component, on affected versions 12.2.3 through 12.2.15. No user interaction is required and attack complexity is low. The practical limiting factor is the need for a valid low-privilege iSupport account: risk is highest where the iSupport portal is internet-facing and permits self-registration or broad external/customer access, and is substantially reduced where iSupport is internal-only or restricted to vetted users. Impact is confined to confidentiality (data disclosure); no integrity or availability impact applies.

This is a moderate-priority vulnerability (CVSS 3.1 base 6.5) whose risk is driven entirely by confidentiality impact (C:H, with I:N/A:N). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low privileges and no user interaction - meaning an attacker who already holds any authenticated iSupport account can reach the flaw easily over HTTP. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active or at-scale exploitation; this is currently a theoretical-but-plausible data-disclosure risk rather than a confirmed in-the-wild threat. One signal is conflicting: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L (the attacker must already be authenticated) and the confidentiality-only impact; the official Oracle description characterizes this as privileged data access, not an auth bypass - verify with the Oracle CPU advisory. Net assessment: a real but second-tier priority - patch in normal cycle, prioritize if the iSupport portal is internet-facing with low-trust/self-registered users.

A low-privileged user with a valid iSupport account (e.g., a self-registered customer or partner on an internet-facing support portal) sends crafted HTTP requests to the Service Requests component and gains unauthorized read access to critical data belonging to other users or the broader iSupport data set. No user interaction or elevated privileges are needed, and the low attack complexity makes exploitation reliable once access to an account exists. No public exploit was identified at the time of analysis.