Oracle iSetup CVE-2026-60795

Exploitation requires possession of a low-privileged Oracle E-Business Suite account (PR:L) - unauthenticated external attackers cannot exploit this vulnerability directly. Network access to the Oracle iSetup application via HTTP is required (AV:N), and the attacker must satisfy unspecified high-complexity preconditions (AC:H), which Oracle's advisory characterizes as 'difficult to exploit' - likely involving specific request construction, parameter manipulation, or environmental conditions not publicly disclosed. The affected functionality is specifically the General Ledger Update Transform and Reports component of Oracle iSetup, versions 12.2.3 through 12.2.15. What limits exploitation: the mandatory low-privileged EBS account requirement excludes unauthenticated threat actors; the high attack complexity narrows the population of attackers capable of successful exploitation; no availability impact constrains the blast radius to data confidentiality and integrity only; and organizations running Oracle EBS outside the 12.2.3-12.2.15 range are not listed as affected.

The CVSS 3.1 score of 6.8 (Medium) reflects a meaningful but constrained attack surface: AV:N and dual high impacts (C:H, I:H) elevate concern, while AC:H and PR:L impose real barriers. Oracle's own description language - 'difficult to exploit' - corroborates AC:H, meaning only technically capable attackers meeting specific unspecified preconditions can succeed. No EPSS score was provided, limiting probabilistic exploitation assessment. Neither a POC nor CISA KEV listing exists at time of analysis, suggesting this is currently a theoretical risk without confirmed in-the-wild exploitation. However, the Authentication Bypass tag combined with high confidentiality and integrity impacts in a financial data context (General Ledger) elevates business risk beyond what the numeric score conveys - unauthorized modification of general ledger transform data could carry material compliance, audit, and financial integrity consequences for affected organizations. This is not a 'high-CVSS-but-low-real-risk' scenario; it is a 'medium-CVSS-but-high-business-risk' case for EBS deployments in regulated industries. The absence of availability impact (A:N) means it is not a service disruption vector. Priority should be patching within the next scheduled Oracle CPU maintenance cycle.

A low-privileged Oracle EBS account holder with network access to the iSetup HTTP interface crafts a specially structured HTTP request targeting the General Ledger Update Transform endpoint, satisfying the high-complexity bypass conditions to circumvent authorization enforcement. Upon successful exploitation, the attacker gains read access to all Oracle iSetup-accessible financial data and the ability to create, modify, or delete critical general ledger records, potentially enabling data exfiltration or tampering with financial reporting integrity without triggering standard access control alerts.