Description
Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupplier Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

Vulnerability in Oracle iSupplier Portal allows a low privileged attacker with network access via HTTP to exploit internal operations components, enabling unauthorized access to critical data or full portal data. The weakness is an authorization failure, exposing confidentiality rather than integrity or availability.

Affected Systems

Affected product: Oracle iSupplier Portal. Versions impacted are 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS base score of 6.5 reflects moderate severity with high confidentiality impact. EPSS data is not available and the flaw is not listed in CISA KEV, indicating no widespread exploitation reports yet. Inferred attack vector is remote HTTP access from an attacker with low privileges; the attacker can directly reach the portal and retrieve data if the access control checks are bypassed. Given the lack of patch information, the risk remains real until a vendor fix is applied.

Generated by OpenCVE AI on October 21, 2026 at 02:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s security patch for CVE‑2026‑101836 as soon as it is released.
  • Restrict HTTP access to the iSupplier Portal to trusted internal networks or VPN endpoints to limit exposure.
  • Review and harden access controls so that only authorized roles can read critical portal data.

Generated by OpenCVE AI on October 21, 2026 at 02:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access in Oracle iSupplier Portal via Low-Privilege HTTP Attack
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupplier Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle isupplier Portal
CPEs cpe:2.3:a:oracle:isupplier_portal:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle isupplier Portal
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Isupplier Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:27:33.125Z

Reserved: 2026-09-28T15:40:09.510Z

Link: CVE-2026-101836

cve-icon Vulnrichment

Updated: 2026-10-27T11:27:21.863Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:39.730

Modified: 2026-10-27T12:16:49.413

Link: CVE-2026-101836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:00:08Z

Weaknesses