---
id: "CVE-2026-101645"
kind: "vulnerability"
aliases: ["CVE-2026-101645"]
title: "Oracle iSetup: flaw in General Ledger transform lets low-privilege users take over"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["general-ledger", "isetup", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["isetup-not-deployed", "version-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:18+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:19:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101645", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle iSetup: flaw in General Ledger transform lets low-privilege users take over

Oracle iSetup, part of Oracle E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components that can be reached over HTTP. A low-privileged attacker with network access can compromise the product and take it over, per the description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iSetup or E-Business Suite release level against the affected range 12.2.3 through 12.2.15 in the Oracle advisory.
- Confirm whether the General Ledger Update Transform and Reports components are in use.

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite that addresses CVE-2026-101645; the specific patch number is unknown from the sources.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101645

## From the sources

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_