---
id: "CVE-2026-91339"
kind: "vulnerability"
aliases: ["CVE-2026-91339"]
title: "Oracle E-Business Suite iSupport: low-privileged users can read critical data over HTTP"
severity: "medium"
cvss: 6.5
epss: 0.0027
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise", "isupport", "oracle-ebs", "service-requests", "vendor"]
not_affected_if: ["no-isupport", "unaffected-version"]
published_at: "2026-10-20T22:20:36+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91339", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91339", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle E-Business Suite iSupport: low-privileged users can read critical data over HTTP

Oracle E-Business Suite's iSupport component, in the Service Requests area, has a flaw that lets a low-privileged user with network access reach data they should not see. An attacker gets unauthorized access to critical data, or to all data iSupport can access, with no user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the iSupport version in use, which the sources list as `12.2.3` through `12.2.15` (affected range)
- unknown for other checks; the sources do not say how to test exposure beyond the version range

## Fix

- Apply the Oracle Critical Patch Update for Oracle E-Business Suite that addresses CVE-2026-91339; the sources do not name the patch or the fixed version

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91339
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91339

## From the sources

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_