CVE-2026-46957: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations)

Synopsis

An authentication-bypass-level takeover vulnerability exists in the Internal Operations component of Oracle iSupplier Portal, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is reachable over the network via HTTP and requires a low-privileged account, but exploitation is difficult due to high attack complexity conditions that must be met. Successful exploitation gives an attacker full control over the iSupplier Portal instance, affecting confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the iSupplier Portal service over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privileged account on the iSupplier Portal is sufficient; no administrator or elevated privileges are needed, but some valid credential is required.

• Victim interactionNot required

  No user interaction is needed; the attacker can execute the attack entirely without any victim taking an action.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must engineer specific conditions such as race conditions, precise timing, or particular environmental states before the exploit will succeed reliably.

Blast Radius

• A successful attacker reads all data accessible to the iSupplier Portal, including supplier records, purchase orders, and internal procurement data.
• A successful attacker modifies or deletes persisted procurement and supplier records within the portal.
• A successful attacker crashes or destabilizes the iSupplier Portal service, making it unavailable to internal and supplier users.
• Combined control over confidentiality, integrity, and availability constitutes a full takeover of the affected iSupplier Portal instance.