EUVD-2026-37252Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv EBS credential
-
DeliveryReach iSetup HTTP endpoint
-
ExploitSubmit crafted General Ledger Transform request
-
ExecutionTrigger iSetup vulnerability
-
PersistTake over iSetup module
-
ImpactRead/modify GL configuration data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the Oracle E-Business Suite application tier over HTTP/HTTPS and hold a valid EBS user account with sufficient responsibility to invoke the Oracle iSetup module's General Ledger Update Transform or Reports functionality (PR:L per Oracle's vector). The target must be running EBS 12.2.3-12.2.15 with iSetup deployed. Limiting factors: requires authentication (any low-privileged EBS account suffices, so the bar is low), requires the iSetup component to be reachable from the attacker's network position (often intranet-only in well-segmented deployments, but frequently internet-exposed via EBS storefronts and partner portals), and no user interaction or scope change is needed. |
| Impact | Signals are mixed but lean toward meaningful enterprise risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack requiring only a low-privileged EBS account and no user interaction, with full CIA impact - a classic high-priority profile. However, the vulnerability is NOT listed in CISA KEV, no EPSS score is supplied in the input, no SSVC decision data is provided, and no public POC is referenced; Oracle CPU advisories are notoriously thin and routinely attract reverse-engineering of the patch within weeks of release. EBS is internet-exposed in many deployments and is a known target for ransomware and intrusion crews, so the PR:L barrier is low - any phished or sprayed EBS user credential is enough. Net assessment: real priority for any organization running EBS 12.2 iSetup, especially internet-exposed instances, though current exploitation appears limited or unconfirmed. |
| Exploit ScenarioDerived | An attacker who has phished or password-sprayed a low-privilege EBS user account with iSetup access logs into the EBS application tier over HTTPS, navigates to (or directly POSTs to) the General Ledger Update Transform / Reports endpoint, and submits a crafted request that abuses the vulnerable component to gain full control of the iSetup module - reading and modifying General Ledger configuration migrations and pivoting deeper into the EBS instance. No user interaction by another party is required, and no public POC has been observed at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover of Oracle iSetup (component of Oracle E-Business Suite 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker reaching the General Ledger Update Transform / Reports component over HTTP. The flaw is rated CVSS 8.8 with full confidentiality, integrity, and availability impact, and no public exploit has been identified at time of analysis. Oracle published the fix in the June 2026 Critical Patch Update.
RemediationAI
Apply the Oracle June 2026 Critical Patch Update for E-Business Suite as described at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; the CPU bundles the iSetup fix for all supported 12.2.x lines). Until the CPU can be deployed, restrict network reachability of the iSetup application URLs to administrative networks only via WebLogic/Oracle HTTP Server URL-firewall rules or an upstream reverse proxy - note this can break legitimate cross-instance setup-migration workflows that iSetup users rely on. Enforce least-privilege EBS responsibilities so general users do not hold the iSetup responsibility (removes the PR:L precondition), audit existing iSetup role assignments, and rotate EBS application passwords that may have been exposed; monitor application-tier access logs for unusual POSTs to General Ledger Update Transform and Reports endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle iSetup is a configuration migration and reporting utility shipped with Oracle E-Business Suite (EBS) 12.2, used to transform and move setup data (including General Ledger configuration) between EBS instances. The affected component - General Ledger Update Transform and Reports - processes user-supplied data via HTTP endpoints exposed through the EBS application tier (typically Oracle HTTP Server / WebLogic). Because no CWE is assigned by Oracle and the advisory text is intentionally sparse (Oracle's standard CPU practice), the precise weakness class is not disclosed, but the combination of low-privileged HTTP access leading to full takeover is consistent with authorization bypass, injection, or insecure deserialization typical of EBS modules.
Know when Oracle Isetup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP endpoint (AV:N), no special conditions beyond a low-privileged EBS account (AC:L, PR:L), no user interaction, and Oracle states full takeover of iSetup yielding C:H/I:H/A:H within the same authorization scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle iSetup, a core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, contains an account takeover vulnerability that allows low-privileged authenticated users to compromise confidentiality, integrity, and availability of critical business data. Organizations running affected EBS versions risk unauthorized access to financial, procurement, and operational records through a single authenticated account compromise. This vulnerability requires immediate patching to prevent credential theft and lateral movement within core financial systems.
Restrict network access to iSetup components via firewall rules (IP whitelist); enforce HTTPS-only communication; implement IP-based access controls; enhance logging and alerting on iSetup authentication events; disable iSetup if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB