CVE-2026-46894

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cspujun2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:isupplier_portal:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto Oracle iSupplier Portal de Oracle E-Business Suite (componente: Home Page). Las versiones soportadas que están afectadas son 12.2.3-12.2.15. Una vulnerabilidad fácilmente explotable permite a un atacante con bajos privilegios y acceso a la red a través de HTTPS comprometer Oracle iSupplier Portal. Los ataques exitosos requieren interacción humana de una persona distinta al atacante. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle iSupplier Portal. Puntuación Base CVSS 3.1 de 8.0 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

Information

Published : 2026-06-17 10:54

Updated : 2026-10-25 23:10

NVD link : CVE-2026-46894

Mitre link : CVE-2026-46894

CVE.ORG link : CVE-2026-46894

JSON object : View

Products Affected

oracle

isupplier_portal

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-46894", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46894", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle iSupplier Portal", "versions": [{"status": "affected", "version": "12.2.3", "versionType": "custom", "lessThanOrEqual": "12.2.15"}]}]}], "published": "2026-06-17T10:54:07.113", "references": [{"url": "https://www.oracle.com/security-alerts/cspujun2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-601"}, {"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle iSupplier Portal de Oracle E-Business Suite (componente: Home Page). Las versiones soportadas que est\u00e1n afectadas son 12.2.3-12.2.15. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con bajos privilegios y acceso a la red a trav\u00e9s de HTTPS comprometer Oracle iSupplier Portal. Los ataques exitosos requieren interacci\u00f3n humana de una persona distinta al atacante. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle iSupplier Portal. Puntuaci\u00f3n Base CVSS 3.1 de 8.0 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:isupplier_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47ED2BA9-41D7-477D-9BCB-D75147A02208", "versionEndIncluding": "12.2.15", "versionStartIncluding": "12.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}