CVE-2026-91339 in iSupport
Summary
by MITRE • 10/21/2026
Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the iSupport component of Oracle E-Business Suite, specifically affecting versions ranging from 12.2.3 through 12.2.15. This security flaw is categorized under Service Requests and represents a significant risk to organizations relying on this enterprise resource planning platform for customer service management operations. The vulnerability stems from an insufficient access control mechanism within the application logic that processes HTTP-based requests related to service request data. Because the defect allows low-privileged attackers with network connectivity via HTTP to exploit the issue, it indicates a failure in server-side validation of user permissions before granting access to sensitive information resources. This type of flaw is commonly associated with broken object level authorization or improper privilege management where the application fails to verify that the authenticated user has sufficient rights to perform specific actions on targeted data objects.
From an operational perspective, the exploitation of this vulnerability enables unauthorized entities to bypass standard authentication and authorization protocols. An attacker who gains low-level access to the network segment hosting the Oracle E-Business Suite instance can craft malicious HTTP requests targeting vulnerable endpoints within the iSupport module. Upon successful execution, these requests allow the attacker to retrieve critical data that should be restricted to higher-privileged users or specific administrative roles. The impact is primarily focused on confidentiality, as indicated by the high severity of the Confidentiality metric in the CVSS scoring model. Attackers can exfiltrate sensitive customer information, internal support tickets, and potentially proprietary business data stored within the service request records. While integrity and availability impacts are currently assessed as negligible for this specific vector, the exposure of confidential data alone poses a severe risk to organizational reputation, regulatory compliance, and competitive advantage.
The technical classification of this vulnerability aligns with CWE-269, which covers Improper Privilege Management, specifically regarding insufficient authorization checks during access control enforcement. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving unauthorized access to data through API endpoints or web application vulnerabilities. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), meaning that no special conditions are required for exploitation beyond network reachability and valid credentials at a low privilege level. The absence of user interaction (UI:N) further simplifies the exploit process, allowing for automated scanning and exploitation tools to target this weakness efficiently across multiple instances simultaneously.
To mitigate this vulnerability, organizations must apply the latest security patches provided by Oracle that address the access control logic within the iSupport component. It is critical to verify that all systems running supported versions of E-Business Suite are updated to a version where this specific flaw has been remediated. In addition to patching, implementing network segmentation strategies can help isolate vulnerable instances from untrusted networks or general user segments. Deploying Web Application Firewalls (WAFs) with rulesets tuned for detecting abnormal HTTP request patterns related to service request endpoints may provide an additional layer of defense against exploitation attempts while patches are being applied. Regular auditing of access logs and monitoring for unusual data retrieval activities can also aid in the early detection of potential compromise events associated with this vulnerability.