{"id":"CVE-2026-101646","kind":"vulnerability","aliases":["CVE-2026-101646"],"related":[],"title":"Oracle E-Business Suite iSetup: high-privilege HTTP flaw allows full product takeover","description":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle iSetup, part of E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components. A high-privileged attacker with network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["finance-systems","isetup","oracle-ebs","self-hosted","vendor"],"not_affected_if":["auth-required","no-ebs-isetup"],"how_to_check":"- Confirm the Oracle E-Business Suite release with the iSetup component, `12.2.3` through `12.2.15` is affected per the sources\n- Check the installed iSetup patch level against Oracle's advisory for this CVE (unknown from the sources)","fix":"- Apply the Oracle Critical Patch Update fix for iSetup in E-Business Suite (exact patch id unknown from the sources)\n- Move to a patched iSetup release above `12.2.15` (exact version unknown from the sources)","status":"open","published_at":"2026-10-20T22:18:18+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:29:14+00:00","updated_at":"2026-10-25T03:29:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:29:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for iSetup in E-Business Suite (exact patch id unknown from the sources)\n- Move to a patched iSetup release above `12.2.15` (exact version unknown from the sources)","reach":"network","title":"Oracle E-Business Suite iSetup: high-privilege HTTP flaw allows full product takeover","impact":"high","summary":"Oracle iSetup, part of E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components. A high-privileged attacker with network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","isetup","finance-systems","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over iSetup, reading, changing and disrupting its data","analyst_note":"Find Oracle's CPU advisory for CVE-2026-101646 to confirm the patch id and whether the flaw is network-reachable without special setup.","how_to_check":"- Confirm the Oracle E-Business Suite release with the iSetup component, `12.2.3` through `12.2.15` is affected per the sources\n- Check the installed iSetup patch level against Oracle's advisory for this CVE (unknown from the sources)","needs_analyst":true,"not_affected_if":["no-ebs-isetup","auth-required"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iSetup component deployed and reachable over HTTP. The attacker must already hold high privileges, so teams that restrict admin accounts and keep iSetup off the public network have reduced exposure. Teams not running E-Business Suite iSetup can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3459,"output_tokens":670,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101646':18A,21A '-2026':17A,20A '/av':143C '12.2.15':100C '12.2.3':99C '3.1':130C,142C '7.2':133C 'access':60B,110C 'affect':97C 'allow':12A,104C 'attack':57B,107C,118C 'avail':73B,137C 'base':131C 'busi':4A,39B,85C 'compon':52B,87C 'compromis':114C 'confidenti':70B,134C 'cve':16A,19A 'cvss':129C,139C,141C 'e':3A,38B,84C 'e-busi':2A,37B,83C 'easili':101C 'eb':28B 'exploit':102C 'financ':23B 'finance-system':22B 'flaw':11A,43B 'full':13A,69B 'general':46B,88C 'h':151C 'h/a':150C 'h/i':149C 'h/ui':146C 'high':8A,55B,105C 'high-privileg':7A,54B 'host':31B 'http':10A,62B,112C 'impact':74B,138C 'integr':71B,135C 'isetup':6A,25B,34B,79C,116C,128C 'l/pr':145C 'ledger':47B,89C 'n/ac':144C 'n/s':147C 'network':59B,109C 'oracl':1A,27B,33B,78C,82C,115C,127C 'oracle-eb':26B 'part':35B 'privileg':9A,56B,106C 'product':14A,67B,80C 'report':51B,92C 'result':123C 'score':132C 'self':30B 'self-host':29B 'success':117C 'suit':5A,40B,86C 'support':93C 'system':24B 'take':64B 'takeov':15A,125C 'transform':49B,91C 'u/c':148C 'updat':48B,90C 'vector':140C 'vendor':32B 'version':94C 'via':111C 'vulner':75C,103C,121C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the iSetup component deployed and reachable over HTTP. The attacker must already hold high privileges, so teams that restrict admin accounts and keep iSetup off the public network have reduced exposure. Teams not running E-Business Suite iSetup can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101646","severity":null,"published_at":"2026-10-20T22:18:18+00:00","modified_at":"2026-10-21T19:16:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}