CVE-2026-46894
published 2026-06-17CVE-2026-46894: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are…
PriorityP346high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
0.17%
6.5th percentile
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | isupplier_portal | 12.2.3 – 12.2.15 | — |
| oracle_corporation | oracle_isupplier_portal | 12.2.3 – 12.2.15 | — |
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
cvelistv5v3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle iSupplier Portal up to 12.2.15 Home Page privilege escalation (Nessus ID 322219)
vuldb·2026-06-24
CVE-2026-46894 [CRITICAL] Oracle iSupplier Portal up to 12.2.15 Home Page privilege escalation (Nessus ID 322219)
A vulnerability identified as critical has been detected in Oracle iSupplier Portal up to 12.2.15. This issue affects some unknown processing of the component Home Page. Performing a manipulation results in privilege escalation.
This vulnerability was named CVE-2026-46894. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
GHSA
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page).
ghsa_unreviewed·2026-06-17
CVE-2026-46894 [HIGH] CWE-352 Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page).
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVEList
CVE-2026-46894: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page)
cvelistv5·2026-06-16·CVSS 8.0
CVE-2026-46894 [HIGH] CVE-2026-46894: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page)
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published