This vulnerability affects Oracle iSupplier Portal, a component of Oracle E-Business Suite (Internal Operations). It allows an attacker with low privileges and network access over HTTP to compromise the portal and read a subset of accessible data without authorization. The vulnerability is rated with a CVSS 3.1 score of 3.1, reflecting low impact primarily on confidentiality. The affected versions explicitly include 12.2.3 through 12.2.15. No vendor advisory explicitly states the availability of a patch or fix for this vulnerability, but Oracle's July 2026 Critical Patch Update advisory references multiple patches across products. The advisory strongly recommends applying available patches promptly. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized read access to a subset of data accessible via Oracle iSupplier Portal. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the risk. The confidentiality impact is low.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. Although no explicit patch link or remediation level is provided for this specific CVE, customers should review the advisory and apply relevant patches for Oracle iSupplier Portal versions 12.2.3 through 12.2.15. Maintaining up-to-date software and promptly applying Oracle Critical Patch Updates is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.