The vulnerability in Oracle EDI Gateway allows a high‑privileged attacker who can reach the system over HTTP to seize control of the gateway component. An attacker could then modify, delete, or exfiltrate the data handled by the gateway, leading to loss of confidentiality, integrity, and availability of the EDI process. The weakness results in a full takeover rather than a partial denial of service or limited exposure.

Oracle Corporation Oracle EDI Gateway versions 12.2.3 through 12.2.15 are affected. Other versions outside this range are not listed as vulnerable.

The CVSS score of 7.2 indicates a high risk. The exploit requires network access over HTTP and high local privileges, meaning it is likely limited to users who still have administrative privileges within the environment. Because EPSS information is unavailable and KEV does not list this issue, the probability of exploitation in the wild is uncertain, but the potential impact is severe. Attackers would need to identify and connect to the vulnerable HTTP endpoint of the gateway and then use the identified flaw to elevate control, which could be automated once the weakness is confirmed.