The Oracle EDI Gateway product of Oracle E‑Business Suite contains a flaw that permits a high‑privileged attacker who can reach the system over an HTTP interface to fully compromise the gateway component. The vulnerability stems from improper privilege management, as evidenced by the CWE‑269 identifier. If successfully exploited, an attacker could take full control of the gateway, modify or delete transaction data, and disrupt the entire electronic‑data‑interchange process, causing serious confidentiality, integrity, and availability damage.

Oracle EDI Gateway versions 12.2.3 through 12.2.15 are affected. The products are part of Oracle E‑Business Suite and run on various operating systems, but only the indicated versions contain the vulnerability. All other releases or earlier are not listed as vulnerable.

The CVSS base score of 7.2 indicates a high level of danger, with a vector that requires network access and high privilege access. The EPSS value is below 1 %, implying the probability of real‑world exploitation is low, and the vulnerability is not currently listed in CISA’s KEV catalog. Nonetheless, an attacker who manages to connect to the vulnerable HTTP endpoint and already possesses administrative or high‑privilege rights could exploit the flaw automatically, making the issue highly actionable for defenders.