{"id":"CVE-2026-91257","kind":"vulnerability","aliases":["CVE-2026-91257"],"related":[],"title":"Oracle E-Business Suite iSupport: low-privilege network attacker reads critical data","description":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's iSupport module, in the Service Requests component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives unauthorized access to critical data held in iSupport.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["isupport","oracle-ebs","self-hosted","service-requests","vendor"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite covering iSupport 12.2.3-12.2.15 (patch number not stated in the sources)","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:51:04+00:00","updated_at":"2026-10-25T03:51:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:51:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite covering iSupport 12.2.3-12.2.15 (patch number not stated in the sources)","reach":"network","title":"Oracle E-Business Suite iSupport: low-privilege network attacker reads critical data","impact":"medium","summary":"Oracle E-Business Suite's iSupport module, in the Service Requests component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives unauthorized access to critical data held in iSupport.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","isupport","service-requests","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical iSupport data over HTTP","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE to confirm the patch number and any configuration or check steps.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Oracle E-Business Suite with the iSupport module in versions 12.2.3 through 12.2.15. The sources do not say which configurations expose the Service Requests component, so the exposure of a given install is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3437,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91257':17A,20A '/av':140C '12.2.15':92C '12.2.3':91C '3.1':130C,139C '6.5':133C 'access':64B,102C,117C,123C,127C 'affect':89C 'allow':96C 'attack':11A,61B,99C,109C 'base':131C 'busi':4A,35B,80C 'complet':122C 'compon':44B,82C 'compromis':106C 'confidenti':134C 'critic':13A,66B,119C 'cve':15A,18A 'cvss':129C,136C,138C 'data':14A,67B,120C,128C 'e':3A,34B,79C 'e-busi':2A,33B,78C 'easili':93C 'eb':24B 'exploit':94C 'flaw':47B 'give':62B 'h/i':146C 'held':68B 'host':27B 'http':58B,104C 'impact':135C 'isupport':6A,21B,38B,70B,74C,107C,126C 'l/pr':142C 'l/ui':143C 'let':49B 'low':8A,52B,97C 'low-privileg':7A,51B 'modul':39B 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'network':10A,101C 'oracl':1A,23B,32B,77C 'oracle-eb':22B 'privileg':9A,53B,98C 'product':75C 'reach':55B 'read':12A 'request':30B,43B,84C 'result':114C 'score':132C 'self':26B 'self-host':25B 'servic':29B,42B,83C 'service-request':28B 'success':60B,108C 'suit':5A,36B,81C 'support':85C 'u/c':145C 'unauthor':63B,116C 'user':54B 'vector':137C 'vendor':31B 'version':86C 'via':103C 'vulner':71C,95C,112C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with the iSupport module in versions 12.2.3 through 12.2.15. The sources do not say which configurations expose the Service Requests component, so the exposure of a given install is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91257","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}