CVE-2026-91338

HighCVSS 7.1

Published: 20/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorized create, delete, or modify critical data and gain unauthorized read access to a subset of iSupport data.

Risk Assessment

Unauthorized modification and reading of data in the iSupport system is possible, compromising integrity and confidentiality. A low-privileged attacker can cause damage.

Recommendation

Update Oracle E-Business Suite iSupport to the latest patched version. Follow the principle of least privilege for user accounts.

Other vulnerabilities in Oracle E-Business Suite iSupport

CVE-2026-91347High
Vulnerability in Oracle E-Business Suite iSupport (component Service Requests) versions 12.2.3-12.2.15. An easily exploitable attack via HTTP network access by a low-privileged attacker allows unauthorized creation, deletion, or modification of data and partial DoS, with potential impact on other products.

Original NVD description (English source)

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS