Oracle iSupplier Portal EUVD-2026-61728

No special conditions - remote unauthenticated exploitation against default configurations of Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via HTTP. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability is the only prerequisite; no authentication, elevated privileges, special configuration, or victim interaction is required. The primary limiting factor is network exposure: organizations that restrict iSupplier Portal to internal networks or VPN-only access reduce exploitability to insider or network-adjacent threats. Internet-facing deployments, which are common given iSupplier's supplier-facing purpose, face the highest risk. Integrity and availability are not impacted - exploitation is confined to unauthorized data read.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 and accurately reflects a high-priority, low-friction exploit path: no authentication, no complexity, network-accessible, and confidentiality impact is rated High. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No KEV listing exists and no POC has been identified, meaning active exploitation is not confirmed - however, the trivial exploitability profile means this should not be deprioritized. Oracle iSupplier Portal is frequently exposed externally to allow supplier access, which significantly elevates real-world risk compared to an internal-only system. The absence of integrity and availability impact (I:N/A:N) limits blast radius to data exfiltration, but the data in question - procurement records, supplier financials, contracts - is typically business-critical and regulated. This is a genuine priority, not a high-CVSS-but-low-real-risk issue.

An external attacker enumerates publicly accessible Oracle EBS URLs and identifies an iSupplier Portal instance at a target organization. Without any credentials, the attacker sends a crafted HTTP GET or POST request to the vulnerable Internal Operations endpoint, bypassing authentication controls, and receives a response containing sensitive supplier procurement data, purchase order details, or financial records. No POC code has been identified, but the low attack complexity means this scenario requires only basic HTTP tooling.