This vulnerability in Oracle iSetup (part of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the system, resulting in potential takeover of Oracle iSetup. The vulnerability impacts the General Ledger Update Transform and Reports components. The CVSS 3.1 score of 8.8 reflects high severity with full confidentiality, integrity, and availability impacts. Oracle has published this issue in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. The advisory urges customers to apply patches without delay and notes that failure to patch has led to successful attacks on previously disclosed vulnerabilities. No explicit patch version for Oracle iSetup is provided in the advisory text, so customers must consult the vendor advisory for current patch availability and installation instructions. Mitigation options before patching include blocking network protocols required for exploitation and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows a low privileged attacker with network access via HTTP to fully compromise Oracle iSetup, leading to complete takeover of the product. The vulnerability affects confidentiality, integrity, and availability of the affected system, as reflected by the CVSS 3.1 base score of 8.8 (high severity). This could result in unauthorized access to sensitive data, unauthorized modifications, and denial of service within Oracle iSetup.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. The vendor advisory does not specify a fixed version but provides patch availability documentation and installation instructions. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them. These mitigations may impact application functionality and should be tested accordingly. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch information and guidance.