Isupport

CVE-2026-60827 Jul 21, 22:18 HIGH This Week

Cross-context integrity compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to manipulate, create, or delete critical data after luring a victim into interacting with malicious content, with impact spilling into other Oracle EBS products due to a scope change. Addressed in Oracle's July 2026 Critical Patch Update, it carries a CVSS 3.1 base score of 7.4 with integrity-only impact and no public exploit identified at time of analysis. The requirement for victim interaction lowers the practical exploitation rate relative to a fully unauthenticated automated attack.

CVE-2026-60824 Jul 21, 22:18 HIGH This Week

Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.

CVE-2026-60823 Jul 21, 22:18 HIGH This Week

Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.

CVE-2026-61257 Jul 21, 22:18 MEDIUM This Month

Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.

CVE-2026-60826 Jul 21, 22:18 MEDIUM This Month

Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.

CVE-2026-60825 Jul 21, 22:18 MEDIUM This Month

Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.

CVE-2024-20944 Jan 16, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

CVE-2021-2097 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2083 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: User Responsibilities). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14686 Jul 15, 18:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2878 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Mail). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2872 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2855 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Admin). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2843 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2815 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2789 Apr 15, 14:15 MEDIUM This Month

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: User Interface). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2668 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2667 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2665 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2662 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2661 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2658 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2829 Jul 23, 23:15 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Service Requests). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10415 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Others). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10175 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Profiles). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-10174 Aug 08, 15:29 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: Service Request). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3371 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3370 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3369 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle iSupport component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2012-5326 Oct 08, 20:55 MEDIUM POC This Month

Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of administrators for requests that add. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.