CVE-2026-46894

Analyzed Analyzed - Analysis Complete

Oracle iSupplier Portal Account Takeover via Cross-Site Scripting

Publication date: 2026-06-17

Last updated on: 2026-06-18

Assigner: Oracle

Description

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-18

Generated

2026-07-08

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46894

EUVD

EUVD-2026-37386

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	isupplier_portal	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Impact Analysis

The impact of this vulnerability is severe, as it can lead to a complete takeover of the Oracle iSupplier Portal. This means an attacker could gain unauthorized access and control, potentially compromising confidentiality, integrity, and availability of the portal and its data.

Executive Summary

This vulnerability exists in the Oracle iSupplier Portal component of the Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows a low privileged attacker with network access via HTTPS to compromise the Oracle iSupplier Portal. However, successful exploitation requires human interaction from someone other than the attacker. If exploited successfully, the attacker can take over the Oracle iSupplier Portal.

Compliance Impact

The vulnerability allows a low privileged attacker with network access to potentially take over the Oracle iSupplier Portal, impacting confidentiality, integrity, and availability of the system.

Such a compromise could lead to unauthorized access to sensitive data, which may affect compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Hi! I’m here to help you understand CVE-2026-46894. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70