This vulnerability exists in the Oracle iSupplier Portal component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is classified under CWE-284 (Improper Access Control). The vulnerability requires network access via HTTP and low privileges to exploit, but exploitation is considered difficult. Successful exploitation can lead to full compromise of the Oracle iSupplier Portal, impacting confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 fixes but does not explicitly state a dedicated patch for this CVE. Oracle advises customers to apply the Critical Security Patch Update without delay to address this and other vulnerabilities.

If exploited, this vulnerability can result in complete takeover of the Oracle iSupplier Portal, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, but the attack complexity is high. There are no known exploits in the wild currently. The impact is rated high severity with a CVSS score of 7.5.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability along with others. Until patches are applied, risk can be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users. Oracle does not provide a specific patch link for this CVE but includes it in the broader Critical Security Patch Update advisory. Patch status is not explicitly confirmed for this CVE alone; customers should consult the Oracle advisory for the latest remediation guidance.