Oracle iSupport CVE-2026-91347

Exploitation requires an authenticated low-privileged account (PR:L) with network HTTP access to the iSupport Service Requests component of Oracle E-Business Suite versions 12.2.3 through 12.2.15; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The key enabling factor is that iSupport is a customer-facing self-service portal, so the required low-privilege credentials may be broadly available (including self-registered portal users). The main limiting factors are the authentication requirement (not fully unauthenticated) and the version constraint to the 12.2.x EBS line; the scope change (S:C) means successful exploitation can affect additional EBS products beyond iSupport itself.

This is a genuine high-priority vulnerability, though not a top-tier emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L, score 8.5) confirms a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change that lets impact spill beyond iSupport into additional Oracle E-Business Suite products - the scope change is the primary driver of the elevated score. Impact is confined to integrity (High) and availability (Low partial DoS); there is explicitly no confidentiality impact (C:N). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The requirement for authenticated (low-privileged) access is a meaningful limiting factor that reduces real-world exposure versus a fully unauthenticated flaw, but Oracle EBS commonly provisions many low-privilege user accounts (including self-registered iSupport portal users), so the PR:L bar may be low in practice. Note the signal gap: Oracle Critical Patch Update advisories historically correlate with eventual exploitation of EBS components, yet no KEV/EPSS/POC data accompanies this entry - treat absence as unknown, not as safe.

A low-privileged user with an iSupport portal account sends crafted HTTP requests to the vulnerable Service Requests component, exploiting the flaw to tamper with or destroy critical data and trigger a partial denial of service. Because of the scope change (S:C), the impact can extend beyond iSupport into other integrated Oracle E-Business Suite modules. No public proof-of-concept was identified in the provided data.