CVE-2026-91257 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle E-Business Suite iSupport systems, particularly those using versions 12.2.3-12.2.15, should assess exposure and verify security controls. They should prioritize verifying exposure and assessing security controls to prevent potential unauthorized access to critical data. This includes reviewing and updating incident response plans and ensuring that compensating controls are in place for exposed systems.

Why it matters

Defenders should prioritize verifying exposure of iSupport versions 12.2.3-12.2.15 and assessing the effectiveness of current security controls to prevent potential unauthorized access to critical data.

• Potential unauthorized access to critical data
• Possible complete access to all iSupport accessible data
• Verification of iSupport version and exposure
• Assessment of security controls and access

Technical summary

The vulnerability in iSupport allows a low-privileged attacker with network access via HTTP to compromise iSupport, potentially leading to unauthorized access to critical data. Successful attacks can result in unauthorized access to critical data or complete access to all iSupport accessible data. The CVSS 3.1 Base Score is 6.5 (Confidentiality impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Defenders should prioritize verifying exposure of iSupport versions 12.2.3-12.2.15 and assessing the effectiveness of current security controls.

Defensive priority

Defenders should prioritize verifying exposure of iSupport versions 12.2.3-12.2.15 and assessing the effectiveness of current security controls.

Recommended defensive actions

• Verify iSupport version and check for exposure
• Assess security controls and access to iSupport
• Review and update incident response plans
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information on exploitation or affected systems is not available. Defenders should verify iSupport version and exposure, assess security controls, and review incident response plans. Limited source detail is available; explicit evidence limits apply. Defensive verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.