EUVD-2026-37386Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable HTTPS portal (AV:N/AC:L), requires a low-privileged supplier account (PR:L) and interaction from a second user (UI:R), and Oracle states takeover yielding full C/I/A impact with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to fully compromise the application by tricking a separate user into interacting with attacker-supplied content over HTTPS. The Home Page component is the entry point, and successful exploitation yields full confidentiality, integrity, and availability impact on the portal. No public exploit identified at time of analysis, but Oracle's critical patch advisory confirms the issue is real and patchable.
Technical ContextAI
Oracle iSupplier Portal is the supplier-collaboration module of Oracle E-Business Suite (EBS), built on the Oracle Application Framework (OAF) running on the EBS middle tier (typically Apache + Oracle HTTP Server fronting WebLogic/Forms). The vulnerable component is the Home Page, which renders authenticated supplier dashboards over HTTPS and consumes user-controllable parameters and shared content. Oracle declined to publish a CWE, but the combination of low-privileged authenticated attacker plus required interaction from a different user is the classic signature of a stored cross-site scripting or HTML-injection issue in the supplier-facing UI that leverages an internal/admin user's session to escalate to portal takeover. The CPE cpe:2.3:a:oracle_corporation:oracle_isupplier_portal narrows scope to the iSupplier Portal product family, not the entire EBS stack.
RemediationAI
Apply the fixes from Oracle's June 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the only vendor-released remediation for iSupplier Portal 12.2.3-12.2.15 (patch available per vendor advisory; no standalone fix version was published in the CVE record itself). Until the CPU bundle can be staged, reduce exposure by restricting the iSupplier Portal to known supplier IP ranges via the reverse proxy or WAF, tightening URL firewall rules in $CONTEXT_FILE to block uncommon Home Page parameters, and instructing internal buyers/approvers not to follow links or open content originating from supplier-controlled fields - recognising that restricting supplier IPs may break legitimate supplier access from new networks and that disabling parts of the Home Page can degrade dashboard functionality. Increase monitoring of FND_LOGINS and audit trails for unusual supplier sessions until the CPU is applied.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today