Vulnerability in Oracle iSetup enables a high privileged attacker with network access via HTTP to take full control of the service. The flaw can be exploited easily by an attacker who already has high privileges, allowing compromise with no user interaction. Once exploited the attacker can gain complete control of Oracle iSetup, resulting in loss of confidentiality, integrity and availability for the affected application and potentially the underlying system.

The affected vendor is Oracle Corporation and the vulnerable component is Oracle iSetup, part of Oracle E‑Business Suite. Affected versions are 12.2.3 through 12.2.15, including the General Ledger Update Transform and Reports features.

The CVSS 3.1 base score of 7.2 reflects significant impacts on confidentiality, integrity and availability. An attacker must already possess high privileges (PR:H) and can exploit the flaw over the network (AV:N). The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but its high CVSS score and network reach suggest it poses a serious risk to exposed systems.