---
id: "CVE-2026-101646"
kind: "vulnerability"
aliases: ["CVE-2026-101646"]
title: "Oracle E-Business Suite iSetup: high-privilege HTTP flaw allows full product takeover"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["finance-systems", "isetup", "oracle-ebs", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "no-ebs-isetup"]
published_at: "2026-10-20T22:18:18+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:29:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101646", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite iSetup: high-privilege HTTP flaw allows full product takeover

Oracle iSetup, part of E-Business Suite, has a flaw in its General Ledger Update Transform and Reports components. A high-privileged attacker with network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release with the iSetup component, `12.2.3` through `12.2.15` is affected per the sources
- Check the installed iSetup patch level against Oracle's advisory for this CVE (unknown from the sources)

## Fix

- Apply the Oracle Critical Patch Update fix for iSetup in E-Business Suite (exact patch id unknown from the sources)
- Move to a patched iSetup release above `12.2.15` (exact version unknown from the sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101646

## From the sources

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_