Description

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupplier Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-18T21:17:31.073Z",
  "pubdate": "2026-08-18T21:17:31.073Z",
  "executiveSummary": "An unauthenticated security vulnerability affects the Oracle iSupplier Portal component of Oracle E-Business Suite versions 12.2.3-12.2.15, specifically within the Internal Operations component.\nThe vulnerability allows remote attackers with network access via HTTP to compromise the affected application, leading to severe confidentiality and integrity impacts.\nSuccessful exploitation grants unauthorized read, create, delete, and modification access to critical data or all accessible data within the Oracle iSupplier Portal.\nThe CVSS 3.1 base score is 7.4 with a vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity risks.\nAttack execution requires network connectivity over the HTTP protocol and leverages high attack complexity without requiring user interaction or prior authentication privileges.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of the Oracle iSupplier Portal, part of the broader Oracle E-Business Suite architecture supporting versions 12.2.3 through 12.2.15.\nThe attack vector is network-based (AV:N), allowing remote threat actors to interact directly with the vulnerable application endpoints over HTTP without prior authentication (PR:N) or user interaction (UI:N).\nThe exploitation method is classified as having high attack complexity (AC:H), implying that successful exploitation requires specific pre-conditions, precise timing, or non-standard configurations to bypass existing defensive boundaries.\nThe attack flow begins with a threat actor sending specially crafted HTTP requests targeting the vulnerable endpoints of the Internal Operations component.\nDue to insufficient input validation, authorization checks, or flawed session handling within the affected component, the application fails to verify whether the incoming request originates from an authorized and authenticated entity.\nUpon successful processing of the crafted payload, the application permits unauthorized execution flows.\nThis behavior results in post-exploitation impacts affecting both data confidentiality (C:H) and data integrity (I:H).\nAn attacker can exploit these weaknesses to read sensitive records, as well as perform unauthorized data creation, modification, and deletion against critical data or the entirety of the Oracle iSupplier Portal accessible data repository, while availability remains unimpacted (A:N)."
}