This vulnerability in Oracle iSupport (Oracle E-Business Suite) version 12.2.3 allows a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability also has scope change implications, meaning it may affect additional Oracle products beyond iSupport. The CVSS 3.1 score of 9.1 reflects critical impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others and strongly urges customers to apply patches promptly. Until patched, risk mitigation may include blocking attack-related network protocols and limiting privileges for users who do not require them, though these may affect functionality.

Successful exploitation allows an attacker with high privileges and network access via HTTP to fully compromise Oracle iSupport, leading to takeover of the system. The vulnerability impacts confidentiality, integrity, and availability of the affected product. Additionally, the attack may have broader effects on other Oracle products due to scope change. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and removing unnecessary privileges or access to certain packages from users who do not need them. These mitigations may impact application functionality, so patching is the preferred and definitive solution.