Live › vulnerability › CVE-2026-101836
Go to dashboardOracle E-Business Suite's iSupplier Portal, in the Internal Operations component, has a flaw that lets an attacker with low privileges and network access over HTTP reach data they should not see. Successful exploitation can expose critical data or all data the iSupplier Portal can access, with no effect on integrity or availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iSupplier Portal deployed and reachable over HTTP. Sites without iSupplier Portal, or running a release outside the affected range, can skip it.
No product ranges from the sources yet.
12.2.3 through 12.2.1512.2.3 to 12.2.15 if a patch is not availableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupplier Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101836")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.