Oracle iSupport CVE-2026-91338

Requires network HTTP access to an Oracle E-Business Suite iSupport deployment (the self-service support portal) running an affected release in the 12.2.3-12.2.15 range, plus a valid low-privileged account (PR:L) such as a registered self-service/customer user - the flaw is NOT exploitable pre-authentication despite the 'Authentication Bypass' tag. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: an attacker must first obtain or self-register a low-privilege account, and the target iSupport module must be enabled and reachable (typically internet-facing, which increases exposure). Impact is bounded to iSupport-accessible data (integrity high, confidentiality low, no availability loss).

This is a genuine mid-to-high priority issue but not a top-tier emergency based on available signals. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) is internally consistent: network-reachable over HTTP, low attack complexity, and requiring only a low-privileged account with no user interaction. The dominant impact is integrity (I:H - unauthorized create/delete/modify of critical iSupport data), with limited confidentiality exposure (C:L - read access to a subset of data) and no availability impact (A:N). No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit/POC was supplied in the intelligence, so there is currently no evidence of active or at-scale exploitation. The practical risk driver is that iSupport is an internet-facing self-service portal and only a low-privileged (e.g., registered customer/self-service) account is needed, which lowers the bar considerably versus a fully authenticated admin flaw. One signal conflict must be flagged: the input Tags include 'Authentication Bypass,' but the CVSS vector explicitly requires PR:L (authenticated) - these are contradictory. The description text ('low privileged attacker') supports PR:L, so the 'Authentication Bypass' tag appears to be an imprecise/incorrect label rather than a confirmed auth-bypass primitive; verify against the Oracle CPU advisory before treating this as pre-auth.

An attacker who holds or self-registers a low-privilege iSupport portal account sends crafted HTTP requests to the Internal operations component, abusing missing authorization checks to read a subset of data and to create, modify, or delete critical iSupport records belonging to other tenants/users. No user interaction or elevated privileges are required. No public proof-of-concept was provided in the intelligence, so exploitation would currently require independent development.