Oracle iSupport, part of Oracle E‑Business Suite, contains a vulnerability that permits a high‑privileged attacker with network access over HTTP to compromise the service. The flaw allows takeover of the entire iSupport instance and may extend impact beyond iSupport to other products in the same stack. The weakness involves an authorization bypass, as indicated by CWE‑284, allowing attackers to gain unauthorized access over HTTP.

Oracle iSupport versions 12.2.3 through 12.2.15 are affected. These versions are publicly supported and remain vulnerable until patched or upgraded.

The CVSS 3.1 base score of 9.1 indicates a critical vulnerability, with significant confidentiality, integrity, and availability impacts. The EPSS score of <1% suggests that exploitation is currently unlikely, but the risk remains high if an attacker gains the required credentials and network access via HTTP. The flaw can affect additional Oracle applications through a scope change, as indicated in the description. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need high privileges and access to the iSupport HTTP interface to exploit the flaw, after they could potentially take over the entire service.