The vulnerability in Oracle iSetup, located in the General Ledger Update Transform and Reports components, allows a network attacker with low privileges to compromise the application through its HTTP interface. If successfully exploited, the attacker can take over the Oracle iSetup instance, leading to complete compromise of confidentiality, integrity, and availability. The weakness is reflected in the CVSS 3.1 score of 7.5 and the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network‑based attack with high complexity and no user interaction.

Affected versions of Oracle iSetup range from 12.2.3 to 12.2.15. The advisory specifically targets the General Ledger Update Transform and Reports components within Oracle E‑Business Suite.

The CVSS base score of 7.5 signals a high‑severity flaw and the absence of an EPSS estimate means the exact probability of exploitation is unknown; however, the vulnerability is not currently listed in CISA’s KEV catalog. Because the attack vector is HTTP and requires only low‑privilege access, an adversary can achieve full takeover by submitting a crafted request to the exposed Oracle iSetup interface. The impact across confidentiality, integrity, and availability is therefore significant if the flaw is exploited.