CVE-2026-91347 Oracle Corporation CVE debrief

Who should care

Defenders managing Oracle E-Business Suite environments, particularly those using iSupport versions 12.2.3-12.2.15, should assess their exposure and prioritize patching or compensating controls to mitigate potential data manipulation and service disruption risks.

Why it matters

CVE-2026-91347 is a high-severity vulnerability in Oracle E-Business Suite's iSupport product, allowing low-privileged attackers to compromise systems and manipulate data. Defenders should prioritize verifying exposure, assessing patch needs, and monitoring for potential impacts.

• Potential unauthorized data modifications by low-privileged attackers
• Partial denial of service (DOS) of iSupport
• Scope change impacts on additional products
• Verification of exposure and patching priority for iSupport versions 12.2.3-12.2.15

Technical summary

The vulnerability in iSupport (component: Service Requests) of Oracle E-Business Suite versions 12.2.3-12.2.15 allows low-privileged attackers with network access via HTTP to compromise iSupport. This could lead to unauthorized creation, deletion, or modification of critical data and partial denial of service (DOS) of iSupport. The CVSS 3.1 Base Score is 8.5, indicating high severity. Defenders should prioritize verifying exposure in their Oracle E-Business Suite environments, particularly for iSupport versions 12.2.3-12.2.15, and assess the need for patches or compensating controls. The vulnerability has a high impact on integrity and availability, and its exploitation could result in significant data

Defensive priority

Defenders should prioritize verifying exposure in their Oracle E-Business Suite environments, particularly for iSupport versions 12.2.3-12.2.15, and assess the need for patches or compensating controls.

Recommended defensive actions

• Verify iSupport version and exposure in Oracle E-Business Suite environments
• Assess the need for patches or updates based on Oracle's security alerts
• Monitor for potential unauthorized data modifications and service disruptions
• Review network access controls and HTTP exposure for iSupport
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert for October 2026 is referenced but not examined in detail. Defenders should verify exposure in their Oracle E-Business Suite environments, particularly for iSupport versions 12.2.3-12.2.15, and assess the need for patches or compensating controls. The vulnerability allows low-privileged attackers with network access via HTTP to compromise iSupport, potentially impacting additional products. Successful attacks

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.