Oracle iSetup CVE-2026-101647

Exploitation requires (1) network/HTTP access to the Oracle E-Business Suite instance hosting the iSetup module (General Ledger Update Transform, Reports component), and (2) a valid low-privileged authenticated EBS account (PR:L) - this is NOT unauthenticated. Limiting factors that reduce realistic risk: the CVSS AC:H flag indicates meaningful, attacker-uncontrollable preconditions (such as a race condition or a specific application state) that must be met for a successful attack, and only EBS deployments on versions 12.2.3 through 12.2.15 running the iSetup component are affected. No end-user interaction is required (UI:N), and scope is unchanged (S:U), so impact is confined to the iSetup component itself.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.5 (High) is driven by full CIA impact (C:H/I:H/A:H, described as 'takeover of Oracle iSetup') over the network (AV:N), but two factors materially temper real-world risk: high attack complexity (AC:H), meaning the attacker must win a race condition or satisfy non-trivial preconditions outside their control, and a required low-privilege authenticated session (PR:L), so this is not a pre-auth internet drive-by. No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the provided data - so there is no evidence of active exploitation or automatable mass-exploitation, and exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent (all point to a difficult, authenticated, high-impact flaw) rather than conflicting. Note one metadata discrepancy to verify: the input Tag labels this 'Information Disclosure,' yet the description and the I:H/A:H metrics indicate full compromise (integrity and availability impact), not merely disclosure - treat the 'Information Disclosure' tag as understating actual impact. Bottom line: patch it in the normal Oracle CPU cycle; it is not a drop-everything emergency absent exploitation evidence, but EBS's role as a crown-jewel ERP system warrants prompt remediation.

An attacker who already holds a low-privilege authenticated account on an internet- or intranet-reachable Oracle E-Business Suite instance sends crafted HTTP requests to the iSetup General Ledger Update Transform / Reports component. By satisfying the difficult preconditions implied by AC:H (e.g., winning a timing/race window or specific state), they escalate to full takeover of the iSetup component with confidentiality, integrity, and availability impact. No public exploit code is identified at time of analysis, so this would currently require original exploit development.