CVE-2026-46937 is a vulnerability in Oracle iSetup, a component of Oracle E-Business Suite (General Ledger Update Transform, Reports), affecting supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle iSetup, potentially leading to full product takeover. The vulnerability has a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impacts. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple Oracle products. Oracle strongly urges customers to apply the Critical Security Patch Update without delay. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle iSetup, resulting in complete takeover of the product. The impact affects confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 8.8.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply this patch promptly to remediate the issue. Until the patch is applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle recommends staying on actively-supported versions and applying security patches without delay.