CVE-2026-46945
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, changing the scope of the threat.
Risk Assessment
This threat can lead to the takeover of Oracle iSupport, which may have serious consequences for data security and system availability within the organization.
Recommendation
It is recommended to update to the latest version of Oracle iSupport and implement appropriate security measures to restrict access to the system only to authorized users.
Other vulnerabilities in Oracle iSupport
See all- CVE-2017-10415High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-10174High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-3371High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Attacks require human interaction, potentially leading to unauthorized access to critical data.
- CVE-2017-3370High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3369High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction and can lead to unauthorized access to critical data.
- CVE-2026-46946Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, increasing the scope of the threat.
- CVE-2026-46944Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. Easily exploitable by a high privileged attacker with network access via HTTP, potentially leading to takeover of Oracle iSupport.
- CVE-2026-91339Medium
Vulnerability in iSupport (component Service Requests) within Oracle E-Business Suite affecting versions 12.2.3-12.2.15. An easily exploitable attack by a low-privileged attacker with network access via HTTP can result in unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-91257Medium
Vulnerability in Oracle iSupport (Service Requests component) versions 12.2.3-12.2.15 allows a low-privileged network attacker via HTTP to gain unauthorized access to critical data or all iSupport data.
- CVE-2026-61257Medium
Vulnerability in Oracle iSupport (Call Back component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can unauthorizedly read and modify data.
Original NVD description (English source)
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS