CVE-2026-60685 in iSupport
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle iSupport, a component of the Oracle E-Business Suite operating under the Internal Operations framework. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this flaw has persisted across multiple iterations of the software lifecycle. The vulnerability's classification as easily exploitable suggests that attackers can leverage standard network-based techniques without requiring privileged access or specialized tools to initiate attacks.
The attack vector utilizes HTTP protocols, making it accessible through standard network connections where an unauthenticated attacker can compromise the system. This represents a significant security concern since HTTP communications are typically considered the most common attack surface for web applications. The requirement for human interaction from individuals other than the attacker introduces an interesting dynamic that aligns with social engineering attack patterns and suggests potential phishing or spear-phishing scenarios where users might be诱导 into performing actions that trigger the vulnerability.
The scope change aspect of this vulnerability presents particular operational concerns as it can impact additional products beyond the primary Oracle iSupport component. This cascading effect demonstrates how vulnerabilities in one system module can create broader security implications across interconnected enterprise applications, potentially affecting data integrity and availability throughout the entire E-Business Suite ecosystem. The CVSS 3.1 base score of 6.1 indicates a moderate severity level that reflects the vulnerability's potential for unauthorized data manipulation and access.
The impact assessment reveals that successful exploitation can lead to unauthorized update, insert, or delete operations against Oracle iSupport accessible data, while also enabling unauthorized read access to specific subsets of data within the system. This dual nature of compromise affects both confidentiality and integrity aspects of the security triad, with the confidentiality impact being particularly concerning given that attackers can access sensitive business data without proper authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms the network accessibility, low attack complexity, lack of privilege requirements, and the need for user interaction as key characteristics.
From a cybersecurity framework perspective, this vulnerability maps to CWE-284 (Improper Access Control) and potentially CWE-352 (Cross-Site Request Forgery), demonstrating how inadequate access controls can create pathways for unauthorized data manipulation. The attack pattern aligns with ATT&CK techniques related to credential access and privilege escalation through application-level vulnerabilities, particularly those involving web application exploitation methods.
Organizations should implement immediate network segmentation measures to limit access to Oracle iSupport components while maintaining visibility into network traffic patterns that might indicate exploitation attempts. Regular security assessments should focus on identifying similar access control weaknesses in other enterprise applications, as this vulnerability demonstrates how interconnected systems can create cascading security risks. Patch management programs must be prioritized to ensure timely deployment of Oracle's security patches, as the extended affected version range suggests this vulnerability has been present for an extended period without adequate mitigation.
The human interaction requirement indicates that security awareness training should be enhanced to educate users about recognizing potentially malicious activities that could trigger this vulnerability. Network monitoring solutions should be configured to detect unusual HTTP request patterns that might indicate exploitation attempts, particularly focusing on the specific Oracle iSupport endpoints. Additionally, implementing proper input validation and access control mechanisms at the application level can provide additional defense-in-depth measures against similar vulnerabilities that might exist in other components of the Oracle E-Business Suite environment.