The Oracle iSupport Service Requests component contains an access‑control weakness that lets an attacker with only low‑privilege network access create, delete, or alter critical data and cause a partial denial of service. The flaw is an example of improper privilege and access management (CWE-284).

Oracle Corporation’s iSupport, versions 12.2.3 to 12.2.15, is affected. The vector indicates that exploitation may also affect other Oracle products integrated with iSupport due to the scope change, but the primary impact remains within iSupport.

The CVSS 3.1 base score of 8.5 reflects high impact on integrity and availability with a low attack complexity and low privileges, and no user interaction required. The EPSS score of <1% indicates that, while exploitation is possible, it is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. The vulnerability can be triggered via HTTP network access to the iSupport web interface; the scope change suggests that a successful attack may elevate to other product components connected to iSupport.