EUVD-2026-37268Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed iSupplier Portal
-
DeliveryObtain supplier-tier credentials
-
ExploitAuthenticate over HTTP
-
ExecutionSend crafted request to Internal Operations
-
PersistSatisfy AC:H trigger conditions
-
ImpactAchieve full module takeover
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network HTTP reach to the Oracle E-Business Suite 12.2 deployment hosting the iSupplier Portal module - typical for internet-facing or extranet supplier portals; (2) valid low-privileged credentials to the iSupplier Portal (PR:L), normally a supplier account; and (3) the target running iSupplier Portal in EBS 12.2.3 through 12.2.15. Exploitation is limited by CVSS AC:H, meaning Oracle considers the attack difficult and dependent on conditions outside the attacker's control (e.g., specific configuration, timing, or environmental factors that Oracle does not enumerate in the public advisory); no user interaction is required (UI:N) and scope is unchanged (S:U), so the takeover stays within the iSupplier module rather than escalating to the wider EBS stack. |
| Impact | Signals are mixed and lean toward 'patch on schedule' rather than 'emergency.' The CVSS vector confirms network reach and full CIA impact (justifying the 7.5 score), but AC:H and PR:L meaningfully constrain mass exploitation: an attacker needs a valid low-privilege account (typically a supplier login) and must satisfy non-default conditions Oracle does not disclose. No EPSS score, no KEV listing, and no public POC were provided, which is consistent with Oracle's CPU disclosure pattern where exploit detail is suppressed. The main caveat is conflict between Oracle's wording ('takeover of Oracle iSupplier Portal') and the input's 'Information Disclosure' tag - full takeover implies more than disclosure, and the tag appears to be a generic categorization rather than authoritative scope; defenders should treat impact as full module compromise per the CVSS vector. |
| Exploit ScenarioDerived | An attacker who has obtained or registered a valid supplier-tier account on a target Oracle E-Business Suite 12.2.x deployment authenticates to the iSupplier Portal and sends a crafted HTTP request to an Internal Operations endpoint, exploiting a server-side flaw under conditions that are difficult to satisfy. On success the attacker achieves full takeover of the iSupplier Portal module, allowing them to read, modify, or disrupt supplier-related data and operations. No public POC has been published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Takeover of Oracle iSupplier Portal (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw is rated CVSS 7.5 with high confidentiality, integrity, and availability impact, but carries high attack complexity, suggesting non-trivial preconditions. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
Apply the fixes from Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to all Oracle E-Business Suite 12.2 environments running iSupplier Portal between 12.2.3 and 12.2.15; Oracle's CPU is the authoritative source for exact patch identifiers and any prerequisite EBS/AD/TXK levels. Until patches are applied, restrict network exposure of the iSupplier Portal endpoint to known supplier networks via WAF or reverse-proxy IP allowlisting (trade-off: legitimate suppliers connecting from new IPs will be blocked), enforce MFA on supplier accounts to raise the cost of obtaining the PR:L foothold the vector requires, and review supplier account inventory to disable dormant or over-privileged accounts. Generic 'apply CPU' is the primary action - patch status: vendor-released patch via Oracle CPU June 2026 (specific version identifiers as published in the CPU matrix).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle iSupplier Portal is a self-service web application within Oracle E-Business Suite (CPE cpe:2.3:a:oracle_corporation:oracle_isupplier_portal) that lets external suppliers interact with buyers - submitting invoices, viewing purchase orders, managing shipments - over HTTP through the EBS middle tier. The affected component is 'Internal Operations,' which generally houses backend processing logic invoked from supplier-facing flows. No CWE was published by Oracle (typical for CPU entries), and the advisory withholds technical detail; the AV:N/AC:H/PR:L/C:H/I:H/A:H vector implies authenticated supplier-level interaction with a server-side flaw that, when triggered through a difficult-to-meet condition, yields full module compromise rather than a simple injection or auth-bypass.
Know when Oracle Isupplier Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach (AV:N), Oracle states difficult to exploit (AC:H), requires a supplier-level account (PR:L), no user interaction, and full takeover of the module yields C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle iSupplier Portal in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to account takeover by authenticated users, creating exposure to unauthorized access of supplier data, procurement records, and supply chain visibility. This CVSS 7.5 vulnerability directly impacts organizations' ability to securely manage supplier relationships and maintain confidentiality of procurement operations. No vendor-released patch is currently available, requiring immediate mitigation and upgrade planning.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Firewall rules and network segmentation limiting remote access to iSupplier Portal; (2) Web Application Firewall (WAF) deployment with rules detecting account takeover attack patterns; (3) Removal or restriction of low-privileged user accounts with portal access; (4) Enhanced monitoring and alerting on authentication events and privilege escalations; (5) Preparation and execution of upgrade plan to move to supported E-Business Suite versions (versions prior to 12.2.3 or after 12.2.15).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB