Oracle iSupport EUVD-2026-47126

Exploitation requires network reachability to the Oracle iSupport 'Internal Operations' component over HTTP on an EBS 12.2.3-12.2.15 instance; per the CVSS vector (PR:N/UI:N) it needs no authentication and no user interaction, and the supplied 'Authentication Bypass' tag aligns with this. The key limiting factor is Oracle's explicit 'difficult to exploit' rating (AC:H), which signals the attacker must meet special conditions outside their direct control - such as a specific server state, configuration, or timing - rather than a single deterministic request. Practically, realistic exposure is confined to EBS deployments where the iSupport module is enabled and its HTTP endpoints are reachable by the attacker (e.g., externally facing customer portals); instances where iSupport is disabled or firewalled off are not exposed.

The signals are mixed and warrant prioritization above generic-high but below drop-everything. CVSS is 7.4 (High) with an unauthenticated network vector (AV:N/PR:N/UI:N), which normally elevates urgency, but Oracle explicitly rates it 'difficult to exploit' (AC:H), meaning special conditions beyond the attacker's control must be met. It is NOT in CISA KEV (no confirmed active exploitation), no POC is referenced, and no EPSS probability was provided, so exploitation likelihood cannot be quantified from the input - the absence of EPSS is a genuine data gap, not evidence of low risk. The 'Authentication Bypass' tag combined with PR:N reinforces that no credentials are needed, which raises real-world concern for internet-exposed EBS instances. SSVC-style reading: exploitation status = none observed, technical impact = total (full read/write to iSupport data), automatable = uncertain given AC:H. Net: a real patch-priority issue for organizations exposing iSupport externally, but the high attack complexity likely makes it targeted rather than mass-exploitable.

An attacker who can reach an internet-exposed Oracle EBS iSupport portal sends crafted HTTP requests to the Internal Operations component that bypass authentication, then reads and modifies critical iSupport data (support records, customer data) without any credentials. The high attack complexity (AC:H) means the attacker must satisfy specific preconditions or timing/configuration factors, so success is more likely for a knowledgeable, targeted adversary than for opportunistic scanning; no public POC is known at time of analysis.