{"id":"CVE-2026-101645","kind":"vulnerability","aliases":["CVE-2026-101645"],"related":[],"title":"Oracle iSetup: flaw in General Ledger transform lets low-privilege users take over","description":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle iSetup, part of Oracle E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components that can be reached over HTTP. A low-privileged attacker with network access can compromise the product and take it over, per the description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["general-ledger","isetup","oracle-ebs","package","self-hosted"],"not_affected_if":["isetup-not-deployed","version-outside-12.2.3-12.2.15"],"how_to_check":"- Check the installed iSetup or E-Business Suite release level against the affected range 12.2.3 through 12.2.15 in the Oracle advisory.\n- Confirm whether the General Ledger Update Transform and Reports components are in use.","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-101645; the specific patch number is unknown from the sources.","status":"open","published_at":"2026-10-20T22:18:18+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:16+00:00","updated_at":"2026-10-25T03:19:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:19:16Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-101645; the specific patch number is unknown from the sources.","reach":"internet","title":"Oracle iSetup: flaw in General Ledger transform lets low-privilege users take over","impact":"high","summary":"Oracle iSetup, part of Oracle E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components that can be reached over HTTP. A low-privileged attacker with network access can compromise the product and take it over, per the description.","category":"package","nicknames":[],"who_cares":["oracle-ebs","isetup","general-ledger","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged attacker takes over the iSetup product over HTTP","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-101645 to get the exact patch and the exposure details; NVD text alone gives no fix.","how_to_check":"- Check the installed iSetup or E-Business Suite release level against the affected range 12.2.3 through 12.2.15 in the Oracle advisory.\n- Confirm whether the General Ledger Update Transform and Reports components are in use.","needs_analyst":true,"not_affected_if":["version-outside-12.2.3-12.2.15","isetup-not-deployed"],"who_is_affected":"Organisations running Oracle E-Business Suite with iSetup in the affected 12.2.3 to 12.2.15 range are exposed. Sites on versions outside that range, or without iSetup deployed, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3460,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101645':16A,19A '-2026':15A,18A '/av':146C '12.2.15':102C '12.2.3':101C '3.1':133C,145C '7.5':136C 'access':65B,113C 'affect':99C 'allow':107C 'attack':62B,110C,121C 'avail':140C 'base':134C 'busi':38B,87C 'compon':51B,89C 'compromis':67B,117C 'confidenti':137C 'cve':14A,17A 'cvss':132C,142C,144C 'descript':76B 'difficult':103C 'e':37B,86C 'e-busi':36B,85C 'eb':26B 'exploit':105C 'flaw':3A,42B 'general':5A,21B,45B,90C 'general-ledg':20B 'h':154C 'h/a':153C 'h/i':152C 'h/pr':148C 'host':30B 'http':57B,115C 'impact':141C 'integr':138C 'isetup':2A,23B,32B,81C,119C,131C 'l/ui':149C 'ledger':6A,22B,46B,91C 'let':8A 'low':10A,60B,108C 'low-privileg':9A,59B 'n/ac':147C 'n/s':150C 'network':64B,112C 'oracl':1A,25B,31B,35B,80C,84C,118C,130C 'oracle-eb':24B 'packag':27B 'part':33B 'per':74B 'privileg':11A,61B,109C 'product':69B,82C 'reach':55B 'report':50B,94C 'result':126C 'score':135C 'self':29B 'self-host':28B 'success':120C 'suit':39B,88C 'support':95C 'take':13A,71B 'takeov':128C 'transform':7A,48B,93C 'u/c':151C 'updat':47B,92C 'user':12A 'vector':143C 'version':96C 'via':114C 'vulner':77C,106C,124C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite with iSetup in the affected 12.2.3 to 12.2.15 range are exposed. Sites on versions outside that range, or without iSetup deployed, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101645","severity":null,"published_at":"2026-10-20T22:18:18+00:00","modified_at":"2026-10-21T19:16:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}