Description
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to critical iSupport data
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle iSupport’s Service Requests component, identified as CWE-200 Information Exposure, allows an attacker with low privileges and basic network access via HTTP to compromise the application. Successful exploitation can result in unauthorized access to critical data and full access to all data that iSupport can expose. The CVSS 3.1 score of 6.5 reflects a significant confidentiality impact.

Affected Systems

The affected product is Oracle E‑Business Suite iSupport, versions 12.2.3 through 12.2.15. The vulnerability is present in the Service Requests module.

Risk and Exploitability

The CVSS base score indicates moderate risk; the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network attacker using a low‑privileged account over HTTP to initiate the exploit.

Generated by OpenCVE AI on October 28, 2026 at 23:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch released for iSupport as documented in the October 2026 CPU alert.
  • Restrict HTTP access to iSupport to trusted internal networks or IP ranges and enforce firewall rules.
  • Review and enforce least‑privilege access controls so that users have only the permissions required for their tasks.
  • If a patch is not yet available, monitor for suspicious activity and consider network segmentation to isolate iSupport from untrusted traffic.
  • Enhance data confidentiality controls and audit logs to mitigate the information exposure weakness (CWE-200).

Generated by OpenCVE AI on October 28, 2026 at 23:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Oracle iSupport Unauthorized Data Access Vulnerability
Weaknesses CWE-284
CWE-285

Wed, 28 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Oracle iSupport Unauthorized Data Access Vulnerability
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle isupport
CPEs cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle isupport
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Isupport
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T18:00:29.546Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91339

cve-icon Vulnrichment

Updated: 2026-10-28T18:00:21.427Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:36.243

Modified: 2026-10-28T19:19:20.653

Link: CVE-2026-91339

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor