CVE-2026-61257: Oracle iSupport Auth Bypass Vulnerability

CVE-2026-61257 Overview

CVE-2026-61257 affects the Oracle iSupport product within Oracle E-Business Suite, specifically the Call Back component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle iSupport data, as well as unauthorized read access to a subset of Oracle iSupport data. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
A low-privileged remote attacker can modify and read a subset of Oracle iSupport data over HTTP without user interaction.

Affected Products

Oracle E-Business Suite - Oracle iSupport 12.2.3
Oracle E-Business Suite - Oracle iSupport versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle iSupport 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61257 published to the National Vulnerability Database (NVD)
2026-07-22 - CVE-2026-61257 last updated in NVD
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61257

Vulnerability Analysis

The vulnerability resides in the Call Back component of Oracle iSupport, an Oracle E-Business Suite module that provides customer self-service support portals. An authenticated attacker holding low privileges can reach the vulnerable code path through standard HTTP requests. The flaw permits partial confidentiality and integrity violations against iSupport-accessible data, but does not impact availability. Because the attack executes over the network with low complexity and no user interaction, exploitation can be automated once an attacker holds any valid low-privileged account. The impact scope is limited to data reachable by the iSupport application context.

Root Cause

The issue maps to [CWE-284] Improper Access Control. The Call Back component does not enforce sufficient authorization checks before performing data operations. As a result, a caller with a low-privileged session can trigger operations against records that should be outside their authorization boundary.

Attack Vector

An attacker with a low-privileged account submits crafted HTTP requests to the iSupport Call Back endpoints. The application processes these requests without adequately validating the caller's authorization for the targeted resource. This yields unauthorized read of a data subset and unauthorized create, update, or delete operations against additional data. No user interaction is required, and no privilege escalation on the operating system is achieved. Oracle has not published exploit details, and no public proof of concept is currently available.

Detection Methods for CVE-2026-61257

Indicators of Compromise

Unexpected HTTP POST or GET traffic to Oracle iSupport Call Back URLs from low-privileged customer accounts.
Unusual write operations (INSERT, UPDATE, DELETE) against iSupport database objects outside of typical business hours or user workflows.
Application audit log entries showing data modifications by accounts that do not normally perform such actions.

Detection Strategies

Enable and forward Oracle E-Business Suite Sign-On Audit, Page Access Tracking, and application audit trails to a centralized SIEM for correlation.
Baseline normal Call Back component request rates per user, then alert on statistically significant deviations.
Correlate iSupport HTTP access logs with database change auditing (FGA or Unified Audit) to identify unauthorized record modifications.

Monitoring Recommendations

Monitor web-tier access logs for repeated requests to iSupport Call Back endpoints from a single low-privileged session.
Track failed and successful authorization checks emitted by the application middle tier.
Alert on any modification of iSupport reference or transactional data by accounts flagged as external self-service users.

How to Mitigate CVE-2026-61257

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update July 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle E-Business Suite instances exposing the iSupport module and confirm patch status through OPatch and AutoConfig reports.
Review low-privileged and self-service iSupport accounts for signs of misuse before patching.

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's documented patch application process for Oracle E-Business Suite 12.2, including running adop in hotpatch or downtime mode as appropriate, and validating middle-tier and database components after deployment. Refer to the Oracle Critical Patch Update July 2026 advisory for patch identifiers and prerequisites.

Workarounds

Restrict network exposure of the iSupport Call Back endpoints to trusted networks using a web application firewall or reverse proxy access rules until patching is complete.
Disable or tightly scope iSupport self-service registration to reduce the population of low-privileged accounts capable of triggering the flaw.
Increase audit granularity on iSupport-accessible tables to detect unauthorized modifications in the interim.

bash

# Verify Oracle E-Business Suite patch level after applying CPU July 2026
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL_2026_BUG_ID>');
EOF