A vulnerability exists in the Home Page component of Oracle iSupplier Portal that allows a low‑privileged attacker with HTTPS network access to compromise the portal. The exploit requires a user other than the attacker to interact, indicating a social‑engineering element. Successful exploitation results in full takeover, compromising confidentiality, integrity, and availability of the portal.

Oracle iSupplier Portal, part of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15. The product is identified only by its human‑readable name.

The CVSS 3.1 base score of 8.0 denotes high severity, while the EPSS of less than 1% indicates low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack surface uses HTTPS network connectivity and relies on a low‑privileged attacker persuading an unrelated user, making initial access easier but still dependent on human interaction. Given these conditions, the risk remains high for organizations that expose the portal externally without stringent controls.