Description
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Compromise of Oracle iSetup
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is found in the General Ledger Update Transform and Reports components of Oracle iSetup, a module of Oracle E‑Business Suite. A low‑privileged attacker who can reach the system over the network via HTTP can exploit the weakness and compromise Oracle iSetup, producing full confidentiality, integrity, and availability impacts as indicated by the CVSS vector.

Affected Systems

Affected versions are Oracle iSetup in Oracle E‑Business Suite from 12.2.3 through 12.2.15. Any deployment of the product in this range is at risk.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 classifies the issue as high severity, with no exploit probability data available and no listing in the CISA KEV catalogue. The vulnerability can be triggered without any user interaction, but the attacker must have some level of local or remote network access to the HTTP interface. Successful exploitation permits complete takeover of the Oracle iSetup service.

Generated by OpenCVE AI on October 21, 2026 at 04:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent security patch for Oracle iSetup identified in Oracle's 2026 October security alert.
  • Restrict the HTTP interface of Oracle iSetup to trusted hosts or internal subnet segments to reduce the attack surface.
  • Continuously monitor Oracle iSetup logs for anomalous access patterns or privilege escalation attempts and react promptly.

Generated by OpenCVE AI on October 21, 2026 at 04:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Oracle iSetup Vulnerability Allows Takeover via HTTP
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle isetup
CPEs cpe:2.3:a:oracle:isetup:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle isetup
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Isetup
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:33:52.892Z

Reserved: 2026-09-28T15:40:09.497Z

Link: CVE-2026-101647

cve-icon Vulnrichment

Updated: 2026-10-21T16:22:13.787Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:19.023

Modified: 2026-10-21T19:16:53.487

Link: CVE-2026-101647

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T04:30:14Z

Weaknesses