Isetup
Monthly
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.