This vulnerability affects Oracle iSupport within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by a high privileged attacker with network access over HTTP, allowing compromise and takeover of Oracle iSupport. The vulnerability also has a scope change, meaning exploitation may impact additional Oracle products beyond iSupport. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update advisory covers this vulnerability among 245 patches. The advisory strongly recommends applying the update promptly to mitigate risk. Until patched, risk reduction may be achieved by blocking attack-related network protocols and removing unnecessary privileges from users. No specific patch version for Oracle iSupport is explicitly stated in the advisory content provided.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle iSupport, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Additionally, the scope change means that other Oracle products integrated or dependent on Oracle iSupport may also be significantly impacted by an attack. This represents a critical risk to organizations using affected versions of Oracle E-Business Suite.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not require them. These mitigations may affect application functionality, so they should be implemented with caution. Patch status is not explicitly confirmed for Oracle iSupport versions 12.2.3-12.2.15 in the advisory; therefore, customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.