A flaw in Oracle iSupport’s Internal Operations component allows an attacker who has high privileges to exploit the service over HTTP. The vulnerability enables the attacker to hijack a session and take full control of iSupport, resulting in compromise of confidentiality, integrity, and availability. The weakness is a high‑severity remote code execution scenario, aligned with improper access control issues.

Affected rely upon Oracle iSupport for Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15. The CNAs list the product as Oracle iSupport, a component of Oracle E‑Business Suite.

The CVSS v3.1 score of 9.1 signifies critical impact, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The vulnerability’s scope change enables attackers to potentially affect other Oracle products beyond the initial target. Exploitation requires network access to the affected HTTP endpoint and a high‑privileged attacker, but the attack is described as easily exploitable even under these constraints.