CVE-2026-91257
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle iSupport (Service Requests component) versions 12.2.3-12.2.15 allows a low-privileged network attacker via HTTP to gain unauthorized access to critical data or all iSupport data.
Risk Assessment
Confidentiality breach may lead to leakage of sensitive information handled by iSupport.
Recommendation
Update iSupport to the latest Oracle-patched version and enforce least privilege.
Other vulnerabilities in Oracle iSupport
See all- CVE-2017-10415High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-10174High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-3371High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Attacks require human interaction, potentially leading to unauthorized access to critical data.
- CVE-2017-3370High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3369High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction and can lead to unauthorized access to critical data.
- CVE-2026-46946Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, increasing the scope of the threat.
- CVE-2026-46945Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, changing the scope of the threat.
- CVE-2026-46944Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. Easily exploitable by a high privileged attacker with network access via HTTP, potentially leading to takeover of Oracle iSupport.
- CVE-2026-91339Medium
Vulnerability in iSupport (component Service Requests) within Oracle E-Business Suite affecting versions 12.2.3-12.2.15. An easily exploitable attack by a low-privileged attacker with network access via HTTP can result in unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-61257Medium
Vulnerability in Oracle iSupport (Call Back component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can unauthorizedly read and modify data.
Original NVD description (English source)
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS