Description

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:30.767Z",
  "pubdate": "2026-08-18T21:17:30.767Z",
  "executiveSummary": "An unauthenticated, network-exploitable vulnerability affects the Internal Operations component of the Oracle iSupplier Portal within Oracle E-Business Suite versions 12.2.3 through 12.2.15.\nThis vulnerability allows remote attackers with network access via HTTP to compromise the affected application without requiring user interaction or authentication.\nSuccessful exploitation results in unauthorized access to critical data, leading to a complete compromise of confidentiality regarding all data accessible via the Oracle iSupplier Portal.\nThe severity of this flaw is reflected by a CVSS 3.1 Base Score of 7.5, with high confidentiality impacts.\nOrganizations utilizing vulnerable versions face significant risks of data exposure and unauthorized information disclosure, necessitating immediate remediation actions as provided by the vendor.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of the Oracle iSupplier Portal, a module of the Oracle E-Business Suite.\nAffected software versions span from 12.2.3 to 12.2.15.\nThe flaw allows an unauthenticated adversary to leverage network access via the HTTP protocol to interact with vulnerable endpoints.\nThe attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring zero privileges (PR:N) and no user interaction (UI:N).\nThe scope remains unchanged (S:U), but the impact on confidentiality is high (C:H), with no integrity (I:N) or availability (A:N) impacts.\nDuring an attack flow, the malicious actor transmits crafted HTTP requests directly to the exposed Oracle iSupplier Portal component.\nDue to insufficient access controls or improper authorization validation within the Internal Operations component, the application fails to verify the identity or permissions of the requester.\nConsequently, the system processes the unauthenticated request and returns sensitive data to the unauthorized entity.\nThe post-exploitation impact is characterized by the unauthorized retrieval of critical enterprise data, potentially exposing proprietary supplier information, financial records, or operational details accessible through the portal interface."
}