CVE-2026-91347

HighCVSS 8.5

Published: 20/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

Vulnerability in Oracle E-Business Suite iSupport (component Service Requests) versions 12.2.3-12.2.15. An easily exploitable attack via HTTP network access by a low-privileged attacker allows unauthorized creation, deletion, or modification of data and partial DoS, with potential impact on other products.

Risk Assessment

An attacker can modify critical data and cause partial service unavailability, posing risk to integrity and availability, and due to scope change may impact additional products.

Recommendation

Update Oracle E-Business Suite iSupport to a patched version and restrict privileges and network access to the Service Requests component.

Other vulnerabilities in Oracle E-Business Suite iSupport

CVE-2026-91338High
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can unauthorized create, delete, or modify critical data and gain unauthorized read access to a subset of iSupport data.

Original NVD description (English source)

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS