Oracle iSupport is vulnerable to a flaw that allows an attacker with high privileges to gain full control over the service via an HTTP request. The flaw can be used to compromise confidentiality, integrity, and availability, effectively permitting a takeover, and corresponds to a remote code execution or privilege‑escalation vulnerability.

This issue affects Oracle Corporation’s Oracle iSupport component of Oracle E‑Business Suite for versions 12.2.3 through 12.2.15. The vulnerability is present in the Internal Operations component and may extend to other Oracle products because of a scope change, so any environment running these versions of iSupport is at risk.

With a CVSS 3.1 base score of 9.1 the vulnerability is critical. The EPSS score indicates exploitation is currently rare (<1%) and it is not listed in the CISA KEV catalog, yet the high severity and scope change imply that a successful attack could have widespread impact. An attacker requires network access over HTTP and must already possess high privileges relative to the target, but the flaw permits full compromise of the iSupport service. The lack of user interaction (UI:N) means an automated exploit could be deployed remotely.