PatchSiren cyber security CVE debrief

CVE-2026-61257 Oracle Corporation CVE debrief

A vulnerability was discovered in the Oracle iSupport product of Oracle E-Business Suite (component: Call Back). The affected versions are 12.2.3-12.2.15. This easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. Organizations should prioritize patching or mitigating this vulnerability to prevent potential data breaches.

Vendor: Oracle Corporation
Product: Oracle iSupport
CVSS: MEDIUM 5.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-22
Advisory published: 2026-07-21
Advisory updated: 2026-07-22

Who should care

Organizations using Oracle E-Business Suite, specifically those with the iSupport product, should be aware of this vulnerability and take necessary actions to protect their systems. IT administrators, security teams, and vulnerability management teams should review the CVE record and vendor guidance to assess the risk and implement appropriate measures.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 5.4, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). This means that the vulnerability can be exploited over the network (AV:N), requires low attack complexity (AC:L), and can be exploited by a low-privileged attacker (PR:L). Successful attacks can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to unauthorized data access and modifications.

Recommended defensive actions

Apply the patches provided by Oracle as soon as possible
Restrict network access to the Oracle iSupport product
Monitor for suspicious activity
Perform regular security audits and vulnerability assessments
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:18:56.470Z and was last modified on 2026-07-22T16:18:44.170Z. The NVD entry is currently in the 'Received' status. The vulnerability affects Oracle iSupport product of Oracle E-Business Suite, specifically versions 12.2.3-12.2.15. Defenders should verify the affected scope and vendor guidance for accurate risk assessment.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:56.470Z and has not been modified since then. The NVD entry is currently Received.