Oracle iSupport: Broken access control in Service Requests
Summary
The iSupport web portal in Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Service Requests component. A network attacker with a low-privileged account can, without user interaction, create, modify or delete data accessible through iSupport and cause a partial denial of service. The CVSS base score is 8.5 according to the CNA record, while VulDB rates it 5.4; the NVD score was still pending at the time of writing.
Affected
- Oracle E-Business Suite 12.2, iSupport component (Service Requests)
- Supported versions 12.2.3 to 12.2.15
- Exploitable via HTTP with a low-privileged account
Fixed in
- Fixed in the Oracle Critical Patch Update of October 2026 (Rev 1 or Rev 2, to be verified)
- Exact patch number and fixed release: Unknown. Details require My Oracle Support login (KA1818, KA923)
Workaround
- Unknown. No vendor workaround is documented in the CVE record.
- Interim measures (not vendor-confirmed): restrict access to iSupport URLs, limit accounts with iSupport access, review web exposure until patched.
Exploitation
- Not listed in CISA KEV.
- EPSS about 0.35 percent.
- No public proof of concept or in-the-wild exploitation found. This is not proof that none exists.
- CISA SSVC: exploitation none, not automatable.
Our recommendation
- Check whether EBS 12.2 with iSupport is in use and identify the exact version.
- Apply the October 2026 Oracle CPU or a later one without delay, after checking the current advisory revision.
- Restrict iSupport to required users and networks, and review whether it is reachable from the internet.
- Monitor iSupport and EBS logs for unusual creation, modification or deletion of service requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alerts October 2026 CPU www.oracle.com
- Oracle Blog: October 2026 Critical Patch Update released blogs.oracle.com
- Oracle EBS Technology Blog: CPU October 2026 blogs.oracle.com
- Vulners CVE-2026-91347 vulners.com
- VulDB 424016 vuldb.com
- OpenCVE CVE-2026-91347 app.opencve.io
- Google Cloud Threat Intelligence: EBS zero-day exploitation cloud.google.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:20.
Original description (NVD)
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.