Isupplier Portal
Monthly
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle iSupplier Portal component of Oracle E-Business Suite (subcomponent: Attachments). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Attachments). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Accounts). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle iSupplier Portal component of Oracle E-Business Suite (subcomponent: Attachments). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.