EUVD-2026-37258Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged iSupport credentials
-
DeliveryReach EBS HTTP tier over network
-
ExploitSend crafted request to Internal Operations endpoint
-
ExecutionAbuse trust boundary (scope change)
-
ImpactTake over iSupport and pivot to adjacent EBS modules
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a high-privilege account in Oracle iSupport (CVSS PR:H) and to be able to reach the iSupport HTTP endpoints over the network; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The vulnerable surface is specifically the 'Internal Operations' component of iSupport on Oracle E-Business Suite versions 12.2.3 through 12.2.15 - earlier or later major branches and EBS deployments without iSupport licensed/enabled are out of scope. The realistic limiting factor is therefore the availability of a privileged iSupport account and network reachability of the EBS HTTP tier from the attacker's position. |
| Impact | The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and 9.1 score are driven almost entirely by the scope change and full CIA impact, not by ease of access - PR:H means an attacker must first hold high privileges in iSupport, which materially limits the realistic threat compared to a PR:N RCE. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so this is not a 'patch tonight or get popped' issue for most environments; it is, however, a serious priority for organizations exposing EBS to large internal/partner user bases where privileged iSupport accounts are common or where account hygiene is weak. The description's claim of 'easily exploitable' should be read in context - Oracle is asserting that once the privilege prerequisite is met, exploitation is straightforward, which is consistent with AC:L. No CWE was published and no technical detail beyond the advisory exists, so the exact bug class is inferred rather than confirmed. |
| Exploit ScenarioDerived | An insider or a compromised business partner who already holds a high-privilege iSupport responsibility (for example through credential phishing or reuse against an EBS user with internal-operations access) sends crafted HTTP requests to the vulnerable iSupport endpoint and pivots beyond iSupport into adjacent E-Business Suite components thanks to the scope change, taking over iSupport data and influencing connected modules. No public exploit code is identified at time of analysis, so initial exploitation would require attacker-developed tooling derived from the patch diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Privileged remote takeover of Oracle iSupport (Oracle E-Business Suite, Internal Operations component) affects versions 12.2.3 through 12.2.15, where an authenticated high-privilege attacker with HTTP access can fully compromise the application with scope change into adjacent E-Business Suite components. The CVSS 9.1 score reflects the cross-component blast radius rather than ease of access, since PR:H means the attacker must already hold elevated privileges. No public exploit identified at time of analysis and the issue is not listed on CISA KEV.
RemediationAI
Apply Patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update fixes for E-Business Suite iSupport as published at https://www.oracle.com/security-alerts/cspujun2026.html, prioritizing the patch corresponding to your exact 12.2.x release level. Until the CPU can be applied, reduce real-world risk by tightening which accounts hold privileged iSupport responsibilities (the PR:H prerequisite is the main gating factor) and by restricting network reachability of the iSupport servlets to trusted networks via Oracle HTTP Server URL firewall (FND: URL Firewall) rules - note that aggressive URL-firewall entries can break legitimate internal-operations flows and should be tested in a clone first. Also rotate and audit any shared/service privileged accounts and enable Oracle EBS auditing on the Internal Operations responsibilities so abuse is detectable; these are mitigations, not fixes, and do not substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle iSupport is the customer self-service module within Oracle E-Business Suite (EBS) 12.2.x, providing web-based ticketing, knowledge base, and account management functions that integrate tightly with other EBS modules (Order Management, TCA, Financials). The affected 'Internal Operations' component handles back-office administrative flows that are normally restricted to privileged operators. Although Oracle did not publish a CWE, the CVSS profile (PR:H, S:C, full CIA at High) is characteristic of an authorization or trust-boundary defect in a privileged EBS servlet that allows a privileged user of iSupport to act on data and operations belonging to neighbouring EBS components - a classic scope-changing privilege/trust-boundary flaw within the shared EBS technology stack (Oracle HTTP Server, WebLogic, Forms, and the APPS schema).
Know when Oracle Isupport gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network HTTP reach (AV:N), straightforward once authorized (AC:L), requires existing high privilege in iSupport (PR:H), no user interaction, and scope change with full CIA impact on adjacent EBS components.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle iSupport (Oracle E-Business Suite Internal Operations) versions 12.2.3 through 12.2.15 contain a critical remote takeover vulnerability (CVSS 9.1) that allows authenticated high-privilege users to fully compromise the application and laterally pivot across adjacent E-Business Suite components. No public exploit identified at time of analysis; however, with no vendor patch currently available, organizations face persistent risk from insider threats and compromised administrative accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: Network-based access controls restricting iSupport HTTP access to authorized administrative networks only; enforce multi-factor authentication for all high-privilege accounts; implement comprehensive audit logging of all administrative sessions; consider operational restrictions on iSupport functionality if business context permits; segregate iSupport database and application servers from other E-Business Suite components to constrain lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Isupport
View allTakeover of Oracle iSupport in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by an authenticated
Full takeover of Oracle iSupport (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.
GitHub PoC
Exploit-DB