EUVD-2026-106053
GHSA-qw73-hj5f-6cvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliveryReach iSetup over HTTP
-
ExploitCraft request to GL Update Transform/Reports
-
ExecutionSatisfy high-complexity trigger conditions
-
ImpactTake over Oracle iSetup component
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid low-privileged Oracle E-Business Suite account (PR:L - not unauthenticated), (2) network HTTP reachability to the Oracle iSetup component, specifically the General Ledger Update Transform/Reports functionality, and (3) only Oracle E-Business Suite 12.2.3 through 12.2.15 is affected. The key LIMITING factor is high attack complexity (AC:H): Oracle rates this 'difficult to exploit,' meaning conditions beyond the attacker's control (specific state, timing, or configuration) must be met, which substantially narrows practical exploitability despite the network attack vector. No user interaction is required (UI:N). |
| Impact | This is a genuinely serious but not top-tier-urgent flaw. The CVSS 3.1 base score of 7.5 is driven by full C:H/I:H/A:H impact (takeover of Oracle iSetup), but two signals pull real-world risk down: AC:H (Oracle explicitly calls it 'difficult to exploit') and PR:L (a valid low-privileged EBS account is required). Oracle's October 2026 Critical Patch Update is the only confirmed source; there is no CISA KEV listing and no EPSS score in the provided data, so exploitation probability cannot be quantified from this input. No public exploit was identified at time of analysis. The SSVC/exploitation picture therefore reads as: high technical impact, non-trivial attack complexity, and authenticated precondition - a 'patch in normal cycle, prioritize if iSetup is internet-reachable' issue rather than an emergency. Note a data tension: the 'Information Disclosure' tag understates impact, since the CVSS vector and description indicate full confidentiality, integrity AND availability compromise (component takeover), not mere disclosure - treat this as a takeover-class flaw and verify affected-version scope against Oracle CPU October 2026. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the iSetup General Ledger Update Transform/Reports functionality and, after meeting the difficult exploitation preconditions, escalates to full control of the iSetup component. No public proof-of-concept exploit was identified; the high attack complexity (AC:H) means exploitation is not point-and-click and likely requires specific timing, state, or configuration to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Full compromise of Oracle iSetup - high confidentiality, integrity and availability impact - is achievable by a low-privileged, authenticated attacker who can reach the General Ledger Update Transform and Reports functionality over HTTP, with Oracle E-Business Suite 12.2.3 through 12.2.15 affected. Oracle rates exploitation as difficult (AC:H), meaning success depends on conditions outside the attacker's control such as a specific component state, timing window, or configuration, which materially narrows practical risk despite the 7.5 base score. No public exploit code or active exploitation was identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, so this should be treated as a high-impact but opportunistic-targeting concern rather than an emergency patch-now event.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in the October 2026 advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) to every E-Business Suite 12.2.3 through 12.2.15 instance running Oracle iSetup; the advisory is the authoritative source for the exact patch/CPU level per version, and no specific patched build number is itemized in the available data - treat this as 'patch available per vendor advisory' and confirm the target CPU level with Oracle Support before scheduling. Because exploitation requires only a low-privileged account plus HTTP reachability to the iSetup GL Update Transform/Reports path, the most effective interim control is to restrict who can reach that functionality: disable or de-register the iSetup responsibility/function from roles that do not operationally require it, and restrict network access to the EBS application tier (reverse-proxy ACLs, VPN-only access, or IP allow-listing for the iSetup servlet paths) - the trade-off is reduced self-service for legitimate setup migration and reporting users. Additionally, inventory and reduce low-privileged EBS accounts that can log in over HTTP, enforce strong authentication on those accounts, and monitor application logs for anomalous iSetup transform/report requests from low-privileged sessions. Note that AC:H means exploitation is state- or configuration-dependent, so hardening the specific GL setup/transform configuration and removing unnecessary demo or duplicate setup data lowers exposure further; none of these controls replaces patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle iSetup is a utility within Oracle E-Business Suite (EBS) 12.2.x used to extract, transform and migrate application setup/configuration data between EBS instances; the affected component covers General Ledger Update Transform and Reports, i.e. the code path that reshapes GL setup records and renders related reporting output. The flaw is reachable over the standard EBS HTTP interface and is exercised through that transformation/reporting logic, with no user interaction required. NVD assigned no CWE, but the impact profile (S:U with C:H/I:H/A:H gained by a PR:L account) points to an authorization or access-control weakness in the transform/report handler that lets a low-privileged session reach data and operations intended for higher-privileged administrators. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U is significant: the attack is remote and unauthenticated user interaction is not needed, but a valid low-privileged EBS account is mandatory and Oracle explicitly models a high attack complexity, indicating a race, state dependency, or configuration precondition that makes reliable exploitation non-trivial. No CPE identifiers were included in the source data, so affected product identification rests on the vendor statement that EBS 12.2.3 through 12.2.15 (EUVD: Oracle iSetup 12.2.3 ≤ 12.2.15) are in scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N) but Oracle-stated 'difficult to exploit' justifies AC:H; a low-privileged EBS account is required so PR:L; description states full component takeover so C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a high-severity flaw in the iSetup General Ledger Update Transform and Reports functionality that could allow a low-privileged attacker to fully compromise confidentiality, integrity, and availability of financial data. Although exploitation is rated difficult and no public exploit or active campaign has been identified, the broad version exposure and finance-critical data at risk warrant management attention and prioritized mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the iSetup General Ledger Update Transform and Reports HTTP endpoints, enforcing least privilege for iSetup and GL users, disabling unused iSetup functionality, deploying WAF rules, and monitoring for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB