This vulnerability affects the Oracle iSupplier Portal component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTPS to compromise the portal, potentially leading to full takeover. Successful exploitation requires user interaction from a third party. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update addresses this and other vulnerabilities, recommending immediate patch application. No separate patch or workaround specific to this CVE is detailed in the advisory.

Successful exploitation can lead to complete compromise of the Oracle iSupplier Portal, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the portal, potentially leading to unauthorized access and control over sensitive supplier and business data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes fixes for this vulnerability among others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. No specific workaround or temporary fix is provided by Oracle for this vulnerability. Patch status is not explicitly confirmed for this CVE alone; customers should consult the vendor advisory for the latest remediation guidance.