Description
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is in Oracle iSupport, a component of Oracle E‑Business Suite handling Service Requests, and allows low‑privileged attackers with network access via HTTP to compromise the system, resulting in unauthorized access to critical data. It is easily exploitable and affects confidentiality.

Affected Systems

Oracle iSupport, versions 12.2.3 through 12.2.15, part of Oracle E‑Business Suite.

Risk and Exploitability

The CVSS 3.1 Base Score of 6.5 indicates moderate severity with a focus on confidentiality. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network access over HTTP, requiring only low privilege, allowing an attacker to gain access to all iSupport‑accessible data.

Generated by OpenCVE AI on October 21, 2026 at 08:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle iSupport patch that addresses CVE‑2026‑91257.
  • Restrict HTTP access to iSupport, allowing only trusted networks or VPN connections.
  • Enforce strict role‑based access controls and audit configuration to limit low‑privileged users from accessing sensitive data.

Generated by OpenCVE AI on October 21, 2026 at 08:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title iSupport Low‑Privilege HTTP Exploit Allowing Unauthorized Data Exposure
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle isupport
CPEs cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle isupport
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Isupport
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:36:29.887Z

Reserved: 2026-09-14T22:10:16.619Z

Link: CVE-2026-91257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:26.763

Modified: 2026-10-28T21:17:18.063

Link: CVE-2026-91257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:00:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control