Oracle iSupport, part of Oracle E-Business Suite, contains a vulnerability that permits a high privileged attacker with network access over HTTP to compromise the service. The flaw allows takeover of the entire iSupport instance and may extend impact beyond iSupport to other products in the same stack. Based on the description, it is inferred that the weakness involves an authentication bypass or improper authorization control, although the CVE entry does not explicitly identify a specific CWE.

Oracle iSupport versions 12.2.3 through 12.2.15 are affected. These versions are publicly supported and remain vulnerable until patched or upgraded.

The CVSS 3.1 base score of 9.1 indicates a critical vulnerability, with significant confidentiality, integrity, and availability impacts. The EPSS score of <1% suggests that exploitation is currently unlikely, but the risk remains high if an attacker gains the required credentials and network access via HTTP. The flaw can affect additional Oracle applications through a scope change, as indicated in the description. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need high privileges and access to the iSupport HTTP interface to exploit the flaw, after which they could potentially take over the entire service.