Oracle iSetup CVE-2026-101646

Exploitation requires the attacker to already possess high application privileges (PR:H) on the target Oracle E-Business Suite instance and network reachability to the iSetup web interface over HTTP; the affected functionality is the General Ledger Update Transform / Reports feature in iSetup on EBS versions 12.2.3 through 12.2.15. The decisive limiting factor is the high-privilege precondition - this is not exploitable by unauthenticated or low-privileged users - which, combined with the typical internal/VPN-gated exposure of EBS back-office modules, substantially narrows the realistic attacker population despite the network vector and low attack complexity. No special non-default configuration is cited beyond having the iSetup component deployed and accessible.

This is a genuine but access-gated vulnerability rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) shows that while the attack is network-borne over HTTP and low-complexity, it requires PR:H - high privileges on the target before exploitation. This single factor is what caps the score at 7.2 despite full Confidentiality/Integrity/Availability impact and complete 'takeover of Oracle iSetup'. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent: the vendor-sourced CVSS correctly reflects a post-authentication privilege/function abuse within an ERP component, not an unauthenticated perimeter breach. The honest conclusion is a real but secondary priority - patch in the normal Oracle CPU cycle, prioritizing EBS instances that are internet-exposed or have many privileged users, but it does not warrant emergency out-of-band response absent new exploitation data. Note the 'Information Disclosure' tag understates the impact, which is full CIA takeover per the CVSS vector.

An attacker who already holds high-privilege application credentials on an Oracle E-Business Suite instance sends crafted HTTP requests to the iSetup General Ledger Update Transform / Reports functionality. Because attack complexity is low and no user interaction is needed, the authenticated actor abuses the exposed function to fully compromise the iSetup component, achieving complete read, modify, and denial impact. No public exploit code is known, so this would currently require attacker-developed tooling.