Oracle iSupplier Portal EUVD-2026-61730

The target must be running Oracle iSupplier Portal version 12.2.3 through 12.2.15 as part of Oracle E-Business Suite, with the Internal Operations component accessible over HTTP from the attacker's network position. No authentication or special user account is required (PR:N). However, exploitation is bounded by AC:H - the attacker must satisfy specific, non-trivial exploitation conditions whose precise nature is not disclosed (likely timing-sensitive, specific HTTP request structure, or session-state dependent based on the Authentication Bypass classification). Installations that are not network-reachable from untrusted zones, or that are protected by strict IP allowlisting for supplier access, face materially reduced risk. There is no user interaction requirement (UI:N), so social engineering is not part of the attack path. Availability impact is absent (A:N), meaning exploitation targets data confidentiality and integrity exclusively.

The CVSS 3.1 score of 7.4 reflects a network-reachable (AV:N), unauthenticated (PR:N) attack path with dual high-severity impacts on confidentiality and integrity, materially tempered by high attack complexity (AC:H). The AC:H designation is the critical differentiating factor: it reduces the likelihood of widespread opportunistic exploitation and makes automated, mass-scale attacks less probable compared to AC:L vulnerabilities of similar scoring. No EPSS score was supplied in the source intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified - consistent with a newly disclosed CPU finding rather than an actively weaponized flaw. However, the Authentication Bypass classification combined with access to all supplier portal data represents a serious threat to Oracle EBS-dependent supply chains, where data integrity underpins procurement workflows. Real-world risk is moderate-to-high for organizations with network-exposed iSupplier Portal instances, but the AC:H barrier meaningfully raises the attacker skill floor.

An unauthenticated attacker with HTTP access to a network-exposed Oracle iSupplier Portal crafts specific requests targeting the Internal Operations component, exploiting an authentication bypass to gain access without valid credentials. Exploitation requires meeting the AC:H condition - such as a specific request sequence, timing window, or session-handling anomaly - placing this above trivial scripted attacks but within reach of a motivated attacker with knowledge of Oracle EBS internals. Once access is established, the attacker reads all supplier portal data (purchase orders, invoices, supplier PII) or injects malicious modifications to critical procurement records.