cve-2026-60826
MEDIUM CVSS 6.6 opencve
Description
Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Timeline
- Published
- 2026-07-21 22:18 UTC
- Last Modified
- 2026-07-31
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 6.6 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
mitre | ||
| 3.1 | 6.6 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
nvd | ||
| 3.1 | 6.6 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
{
"cve": "CVE-2026-60826",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "semver",
"value": "[12.2.3,12.2.15]"
}
}
],
"enrichment": {
"confidence": 95.0,
"confidence_source": "inferred",
"scores": [
{
"score": 95.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Oracle iSupport",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "isupport",
"vendor": "oracle"
}
],
"created": "2026-07-22T19:00:15.036483+00:00",
"title": "High-Privilege Remote Takeover of Oracle iSupport",
"updated": "2026-08-04T02:45:02.799630+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$isupport"
]
},
"epss": {
"score": 0.00375
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*"
],
"created": "2026-07-21T21:37:05.561000+00:00",
"description": "Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 6.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/60xxx/CVE-2026-60826.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-24T15:18:32.489000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$isupport"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*"
],
"created": "2026-07-21T22:18:20.567000+00:00",
"description": "Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 6.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-60826.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-31T17:46:57.120000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$isupport"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-07-21T22:00:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$isupport"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$isupport"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 6.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "07c86890-8281-4eab-917b-ba0d29745e49"
},
{
"created": "2026-07-23T22:45:00+00:00",
"data": [
{
"details": {
"new": "High Privilege Escalation and Takeover via HTTP in Oracle iSupport",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "a9bcdb68-79cd-49ce-a696-1e198df6681b"
},
{
"created": "2026-07-25T19:30:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "fdf2bdc3-e02b-487f-9a1a-5f76bbad50a7"
},
{
"created": "2026-08-01T05:30:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "High Privilege Escalation and Takeover via HTTP in Oracle iSupport"
},
"type": "title"
}
],
"id": "d4caec15-b431-42d0-a93a-73da445e8306"
},
{
"created": "2026-08-02T21:15:00+00:00",
"data": [
{
"details": {
"new": "High-Privilege Remote Takeover of Oracle iSupport",
"old": null
},
"type": "title"
}
],
"id": "f210cd58-d0ea-43fa-8760-d290e094b418"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:isupport:*:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-07-21T21:37:05.561000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 6.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00375
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "High-Privilege Remote Takeover of Oracle iSupport",
"provider": "enrichment"
},
"updated": {
"data": "2026-08-02T21:00:06.476317+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$isupport"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-07-21T21:37:05.561000+00:00",
"description": "Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-07-24T15:03:44.493000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/60xxx/CVE-2026-60826.json",
"weaknesses": [
"CWE-284"
]
}
}