{"id":"CVE-2026-91339","kind":"vulnerability","aliases":["CVE-2026-91339"],"related":[],"title":"Oracle E-Business Suite iSupport: low-privileged users can read critical data over HTTP","description":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's iSupport component, in the Service Requests area, has a flaw that lets a low-privileged user with network access reach data they should not see. An attacker gets unauthorized access to critical data, or to all data iSupport can access, with no user interaction.","severity":"medium","cvss":6.5,"epss":0.0027,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","isupport","oracle-ebs","service-requests","vendor"],"not_affected_if":["no-isupport","unaffected-version"],"how_to_check":"- Confirm the iSupport version in use, which the sources list as `12.2.3` through `12.2.15` (affected range)\n- unknown for other checks; the sources do not say how to test exposure beyond the version range","fix":"- Apply the Oracle Critical Patch Update for Oracle E-Business Suite that addresses CVE-2026-91339; the sources do not name the patch or the fixed version","status":"open","published_at":"2026-10-20T22:20:36+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:50:57+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:50:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Oracle E-Business Suite that addresses CVE-2026-91339; the sources do not name the patch or the fixed version","reach":"network","title":"Oracle E-Business Suite iSupport: low-privileged users can read critical data over HTTP","impact":"medium","summary":"Oracle E-Business Suite's iSupport component, in the Service Requests area, has a flaw that lets a low-privileged user with network access reach data they should not see. An attacker gets unauthorized access to critical data, or to all data iSupport can access, with no user interaction.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","isupport","service-requests","enterprise"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads critical iSupport data over HTTP with a low-privileged account","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched iSupport version, since the sources give only the affected range and no fix.","how_to_check":"- Confirm the iSupport version in use, which the sources list as `12.2.3` through `12.2.15` (affected range)\n- unknown for other checks; the sources do not say how to test exposure beyond the version range","needs_analyst":true,"not_affected_if":["unaffected-version","no-isupport"],"who_is_affected":"Organizations running Oracle E-Business Suite iSupport in the affected versions `12.2.3` through `12.2.15`, where the Service Requests component is reachable over HTTP by a low-privileged account. Teams not running Oracle E-Business Suite, or running an unaffected release, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3437,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-91339':19A,22A '/av':152C '12.2.15':104C '12.2.3':103C '3.1':142C,151C '6.5':145C 'access':57B,68B,78B,114C,129C,135C,139C 'affect':101C 'allow':108C 'area':44B 'attack':65B,111C,121C 'base':143C 'busi':4A,35B,92C 'complet':134C 'compon':39B,94C 'compromis':118C 'confidenti':146C 'critic':13A,70B,131C 'cve':17A,20A 'cvss':141C,148C,150C 'data':14A,59B,71B,75B,132C,140C 'e':3A,34B,91C 'e-busi':2A,33B,90C 'easili':105C 'eb':27B 'enterpris':23B 'exploit':106C 'flaw':47B 'get':66B 'h/i':158C 'http':16A,116C 'impact':147C 'interact':82B 'isupport':6A,24B,38B,76B,86C,119C,138C 'l/pr':154C 'l/ui':155C 'let':49B 'low':8A,52B,109C 'low-privileg':7A,51B 'n':160C 'n/a':159C 'n/ac':153C 'n/s':156C 'network':56B,113C 'oracl':1A,26B,32B,89C 'oracle-eb':25B 'privileg':9A,53B,110C 'product':87C 'reach':58B 'read':12A 'request':30B,43B,96C 'result':126C 'score':144C 'see':63B 'servic':29B,42B,95C 'service-request':28B 'success':120C 'suit':5A,36B,93C 'support':97C 'u/c':157C 'unauthor':67B,128C 'user':10A,54B,81B 'vector':149C 'vendor':31B 'version':98C 'via':115C 'vulner':83C,107C,124C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite iSupport in the affected versions `12.2.3` through `12.2.15`, where the Service Requests component is reachable over HTTP by a low-privileged account. Teams not running Oracle E-Business Suite, or running an unaffected release, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91339","severity":null,"published_at":"2026-10-20T22:20:36+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91339","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91339","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}