CVE-2026-60827
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle iSupport (component: Internal Operations) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit this flaw, requiring user interaction, to gain unauthorized create, delete, or modify access to critical data, potentially affecting other products.
Risk Assessment
The risk includes integrity breach in Oracle iSupport and potentially other systems, leading to unauthorized changes and attack propagation.
Recommendation
Apply the security patch from Oracle immediately and educate users to avoid interacting with suspicious requests.
Other vulnerabilities in Oracle iSupport
See all- CVE-2017-10415High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-10174High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-3371High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Attacks require human interaction, potentially leading to unauthorized access to critical data.
- CVE-2017-3370High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3369High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction and can lead to unauthorized access to critical data.
- CVE-2026-46946Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, increasing the scope of the threat.
- CVE-2026-46945Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, changing the scope of the threat.
- CVE-2026-46944Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. Easily exploitable by a high privileged attacker with network access via HTTP, potentially leading to takeover of Oracle iSupport.
- CVE-2026-61257Medium
Vulnerability in Oracle iSupport (Call Back component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can unauthorizedly read and modify data.
- CVE-2026-60824High
Vulnerability in Oracle iSupport (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can access critical data, with impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).