# CVE-2026-61257: Oracle iSupport unauthorized data access in Call Back component

Source: https://junglewise.ai/threats/cve-2026-61257-oracle-isupport-unauthorized-data-access-in-call-back-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-61257 · Severity: medium · CVSS 5.4 · Published 2026-07-21

Oracle iSupport, a customer service portal within the Oracle E-Business Suite, contains a vulnerability in its Call Back component. An authorized user with low-level permissions could exploit this flaw to view, modify, or delete certain customer support data. This could lead to unauthorized changes to service records or the exposure of sensitive support information.

Technologies: [Oracle Isupport](https://junglewise.ai/threats/technologies/isupport). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-61257 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61257 being exploited in the wild.

**How severe is CVE-2026-61257?** Medium severity, with a CVSS score of 5.4, published 21 July 2026.

**Which products and versions are affected?** Oracle Isupport 12.2.3-12.2.15.

**Is there a fix for CVE-2026-61257?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-61257 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61257?** Check whether you run Oracle Isupport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Call Back component of Oracle iSupport (part of Oracle E-Business Suite) affecting versions 12.2.3 through 12.2.15. The flaw is easily exploitable by a low-privileged attacker with network access via HTTP. Successful exploitation allows the attacker to perform unauthorized 'update, insert, or delete' operations on a subset of iSupport data, as well as unauthorized read access to specific data sets. The vulnerability is tracked as part of the Oracle July 2026 Critical Patch Update.

## Affected products

- Oracle iSupport 12.2.3-12.2.15

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update released

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle iSupport integrity vulnerability in Internal Operations](https://junglewise.ai/threats/cve-2026-60827-oracle-isupport-integrity-vulnerability-in-internal-operations)
- [Oracle iSupport takeover in Internal Operations](https://junglewise.ai/threats/cve-2026-60826-oracle-isupport-takeover-in-internal-operations)
- [Oracle iSupport takeover in Internal Operations](https://junglewise.ai/threats/cve-2026-60825-oracle-isupport-takeover-in-internal-operations)
- [Oracle iSupport data compromise in Internal Operations](https://junglewise.ai/threats/cve-2026-60823-oracle-isupport-data-compromise-in-internal-operations)
- [Oracle iSupport unauthorized data access in Internal Operations](https://junglewise.ai/threats/cve-2026-60685-oracle-isupport-unauthorized-data-access-in-internal-operations)