Oracle iSupport EUVD-2026-37259

Exploitation requires (1) network HTTP reachability to the Oracle E-Business Suite application tier hosting the iSupport module, (2) the target running an affected EBS 12.2.x release between 12.2.3 and 12.2.15 inclusive with the iSupport product deployed and the 'Internal Operations' component active, and (3) an authenticated session with high privileges within iSupport/EBS (PR:H per CVSS vector) - anonymous or low-privilege EBS users cannot trigger the flaw. No user interaction is required (UI:N). Limiting factors: the PR:H prerequisite means exploitation hinges on prior credential theft, account abuse by an insider, or chaining with a separate privilege-escalation bug; deployments that do not expose the EBS web tier beyond internal networks further reduce reachable attack surface.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity attack that nonetheless requires high privileges, which materially gates real-world exploitability: an attacker must already hold an elevated EBS account (administrative or equivalent role on iSupport) before the flaw produces its high impact. The scope change (S:C) is the dominant driver of the 9.1 score because impact spills into other EBS products, but PR:H means this is not a mass-exploitation candidate. There is no EPSS data, no SSVC decision provided, no KEV listing, and no POC reference in the supplied intelligence - so the practical risk profile is 'critical-if-an-insider-or-compromised-admin-account-is-in-play,' not internet-spray. Oracle's CPU advisories are routinely targeted by post-quarter reverse-engineering, so the window between patch publication and weaponized exploit attempts against unpatched EBS instances should still be treated as short.

An attacker who has obtained or is assigned a high-privileged Oracle EBS account - for example, a compromised iSupport administrator credential reused from a phishing campaign, or a malicious insider with elevated responsibilities - sends crafted HTTP requests to the iSupport Internal Operations endpoints on the EBS application tier. The request triggers the scope-changing flaw to fully take over the iSupport module and pivot to manipulate confidentiality, integrity, and availability of additional EBS components such as related self-service or back-office modules. No public exploit identified at time of analysis.