An attacker with limited privileges who can reach the Oracle iSupport service over HTTP on the network can exploit a weakness that allows creation, deletion, or alteration of data and also permits reading of a subset of iSupport data. The vulnerability does not provide remote code execution but directly compromises data integrity and confidentiality, as reflected by a CVSS‑3.1 Base Score of 7.1 with low attack complexity and low required privileges.

Oracle Corporation’s iSupport component of Oracle E‑Business Suite affected versions 12.2.3 through 12.2.15 are vulnerable. The issue resides in the Internal operations module and requires an authenticated low‑privileged user to activate the exploit over HTTP.

The CVSS score of 7.1 indicates high impact for confidentiality and integrity, though availability is not affected. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting a moderate likelihood of exploitation in the wild. An attacker can leverage network connectivity and standard HTTP access to trigger the flaw, but no additional exploitation conditions are disclosed, making it relatively straightforward for an insider or compromised host to execute the attack.