This vulnerability affects Oracle iSupplier Portal component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the portal, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and urges customers to apply patches without delay.

Successful exploitation allows unauthorized access to critical or all data accessible through Oracle iSupplier Portal, potentially exposing sensitive business information. There is no impact on data integrity or system availability reported. The vulnerability is remotely exploitable without authentication, increasing risk.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.