CVE-2026-60824
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle iSupport (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker via HTTP can access critical data, with impact on other products.
Risk Assessment
Risk of unauthorized access to critical data, potentially spreading to other systems.
Recommendation
Apply the patch from Oracle Critical Patch Update (CPU).
Other vulnerabilities in Oracle iSupport
See all- CVE-2017-10415High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-10174High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2017-3371High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Attacks require human interaction, potentially leading to unauthorized access to critical data.
- CVE-2017-3370High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. It requires human interaction from a person other than the attacker, and attacks may significantly impact additional products.
- CVE-2017-3369High
Vulnerability in the Oracle iSupport component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction and can lead to unauthorized access to critical data.
- CVE-2026-46946Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, increasing the scope of the threat.
- CVE-2026-46945Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite allows a high privileged attacker with network access via HTTP to compromise Oracle iSupport. Attacks may significantly impact additional products, changing the scope of the threat.
- CVE-2026-46944Critical
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. Easily exploitable by a high privileged attacker with network access via HTTP, potentially leading to takeover of Oracle iSupport.
- CVE-2026-91339Medium
Vulnerability in iSupport (component Service Requests) within Oracle E-Business Suite affecting versions 12.2.3-12.2.15. An easily exploitable attack by a low-privileged attacker with network access via HTTP can result in unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-91257Medium
Vulnerability in Oracle iSupport (Service Requests component) versions 12.2.3-12.2.15 allows a low-privileged network attacker via HTTP to gain unauthorized access to critical data or all iSupport data.
Original NVD description (English source)
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

