EUVD-2026-106593
GHSA-78wj-vp5p-wgrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege iSupport account
-
ExploitSend crafted HTTP request to Service Requests
-
ExecutionBypass data authorization checks
-
ImpactRead confidential iSupport data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege account that can reach the iSupport Service Requests component over HTTP (PR:L); this is typically a self-service support/customer portal login rather than an administrator. No user interaction is needed and attack complexity is low, so any authenticated low-trust user can attempt it against default configurations of affected Oracle E-Business Suite iSupport 12.2.3-12.2.15. The principal limiting factor is the authentication requirement - fully anonymous/unauthenticated internet attackers cannot exploit it - so exposure scales with how many low-privilege iSupport accounts exist and whether the portal is externally reachable; impact is confined to confidentiality (data disclosure) with no integrity or availability effect. |
| Impact | This is a moderate, authenticated information-disclosure flaw rather than a top-tier emergency, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5 MEDIUM) describes a network-reachable, low-complexity attack that requires an attacker to already hold a low-privilege account on iSupport (PR:L) and yields high confidentiality impact only - no integrity or availability loss. There is no EPSS score, no CISA KEV listing, and no public POC supplied in the input, so exploitation status is 'no public exploit identified at time of analysis'; nothing here indicates active, widespread exploitation. One signal conflicts with the metadata: the input carries an 'Authentication Bypass' tag, but PR:L in the CVSS vector means valid (low) credentials are required - this is a privilege/data-access issue by an authenticated user, not an unauthenticated bypass, so the tag appears mislabeled and should not drive prioritization. Net: a real but prioritizable issue, most urgent where many low-trust users (e.g., external/self-service support portal accounts) can reach iSupport; patch via the Oracle Critical Patch Update, but it does not warrant the emergency response reserved for unauthenticated RCE or KEV-listed bugs. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege iSupport account (for example a self-service customer/support portal login) sends crafted HTTP requests to the Service Requests component and retrieves confidential data belonging to other users or tenants that they should not be able to view. No public exploit code is identified in the provided data, and the attack needs no user interaction and only low attack complexity once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Information disclosure in Oracle iSupport, the customer self-service module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), lets a low-privilege account holder read data well beyond their intended scope - up to and including all data the iSupport Service Requests component can reach - over plain HTTP. Oracle's October 2026 Critical Patch Update credits the flaw with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and no special conditions beyond a valid self-service login; there is no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so the practical risk scales with how many low-privilege iSupport accounts exist and whether the portal is internet-facing - this is a moderate, authenticated data-exposure issue rather than an unauthenticated emergency.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update - the fix for this issue is delivered through the EBS Release 12.2 CPU/RUP chain documented at https://www.oracle.com/security-alerts/cpuoct2026.html; patch availability is confirmed via that vendor advisory, but no exact bundle or one-off patch number is present in the available data, so confirm the applicable AD/TXK and EBS patch levels for your 12.2.x codelevel before scheduling the outage. Where the CPU cannot be applied immediately, the highest-value compensating control is reducing the population and reachability of low-privilege accounts: audit and prune or expire unused self-service/customer iSupport registrations, enforce least privilege and strong identity proofing on portal self-registration, and restrict Service Requests access to known partner networks - the trade-off is that external customers lose self-service access unless fronted by VPN or identity-aware proxy. Blocking or fronting the iSupport servlet at the reverse proxy or WAF (allow-listing only the specific Service Requests and login paths you need, and rate-limiting object-ID enumeration) raises the cost of exploitation but does not fix the underlying authorization gap and must be tuned carefully to avoid breaking legitimate SR workflows. Additionally, because impact is confidentiality-only, enable iSupport audit logging and SR access monitoring to detect enumeration or cross-account object access, accepting that logging adds storage and review overhead. Removing the iSupport module entirely, if it is deployed but unused, eliminates exposure with no functional cost beyond decommissioning effort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iSupport is the service-request and knowledge-base front end of Oracle E-Business Suite, typically deployed as a Java/HTML-DB application (the iSupport servlet stack) that authenticates self-service customers, employees, and partners against the EBS instance and renders Service Requests, notes, and attached content. The vulnerability sits in the Service Requests component and is classified by Oracle as an easily exploitable, confidentiality-only flaw; no CWE identifier is present in the available data, but the assessed impact profile (network-reachable, low complexity, low privileges required, high confidentiality impact, no integrity or availability effect) is consistent with a missing or improperly enforced authorization check on Service Request objects rather than memory corruption. The CVSS vector PR:L is the controlling constraint: the attacker must already hold a valid low-privilege iSupport session - normally a customer/self-service portal login, not an administrator - and the attack is performed by manipulating requests to the Service Requests handlers over HTTP. Third-party tagging labels the issue an authentication bypass, but the independently assessed vector requires an authenticated session, so the accurate characterization is privilege-scoped data access within iSupport, not anonymous entry. Affected deployments are EBS 12.2.3-12.2.15 running iSupport; EUVD records the same version range as 'iSupport 12.2.3 ≤ 12.2.15'.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP reach with low complexity and no UI, but a low-privilege account is required (PR:L); impact is high confidentiality only, with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB