Technical impact
A low‑privileged attacker with network access to the Oracle iSupplier Portal can exploit a vulnerability in the Internal Operations component, allowing the attacker to take over the portal. This weakness is an Improper Access Control flaw, permitting unauthorized takeover. Once successfully compromised, the attacker gains full confidentiality, integrity, and availability control of the portal. The CVSS 3.1 score of 7.5 reflects these severe impacts.
Affected Systems
The affected product is Oracle iSupplier Portal, part of Oracle E‑Business Suite, for which versions 12.2.3 through 12.2.15 are impacted.
Risk and Exploitability
The vulnerability has a high CVSS score of 7.5 and a very low EPSS score of less than 1%, indicating that exploitation is unlikely at present. It is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP connection to the portal, inferred from the description that an attacker with network access can exploit it. No public exploit is known, but the potential for a complete takeover makes it highly critical if exploited.
