---
id: "CVE-2026-91257"
kind: "vulnerability"
aliases: ["CVE-2026-91257"]
title: "Oracle E-Business Suite iSupport: low-privilege network attacker reads critical data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["isupport", "oracle-ebs", "self-hosted", "service-requests", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:51:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91257", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle E-Business Suite iSupport: low-privilege network attacker reads critical data

Oracle E-Business Suite's iSupport module, in the Service Requests component, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives unauthorized access to critical data held in iSupport.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite covering iSupport 12.2.3-12.2.15 (patch number not stated in the sources)

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91257

## From the sources

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_