Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle EDI Gateway allows an attacker who has high privileges and can access the system over the network via HTTP to compromise the gateway. Because the flaw can be exploited easily, it can lead to a full takeover of the EDI Gateway, impacting confidentiality, integrity, and availability. The flaw falls under improper authorization and privilege escalation weaknesses.

Affected Systems

Oracle EDI Gateway, versions 12.2.3 through 12.2.15, are confirmed affected. The affected component is the All Miscellaneous EDI Issues part of the Oracle E‑Business Suite.

Risk and Exploitability

The CVSS v3.1 base score of 7.2 indicates high severity. The EPSS score of approximately 0.00499 (<1%) indicates a very low but non‑zero exploitation probability, suggesting that attacks are currently unlikely but possible. The vulnerability is not listed in the CISA KEV catalog, but the fact that a high‑privileged network attacker can compromise the gateway via HTTP makes it a high‑impact risk. The attack vector is inferred to be network‑based over HTTP, with high privileges and no user interaction required, suggesting that anyone who can reach the gateway can take advantage immediately.

Generated by OpenCVE AI on November 6, 2026 at 22:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle EDI Gateway patch or upgrade to version 12.2.16 or later to fix the vulnerability.
  • Block or restrict HTTP access to the EDI Gateway to trusted IP addresses or subnets only.
  • Ensure that only authorized high privileged accounts can authenticate against the gateway and consider enabling multi‑factor authentication for those accounts.

Generated by OpenCVE AI on November 6, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote High‑Privilege Compromise of Oracle EDI Gateway via HTTP

Fri, 06 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-306

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Remote High‑Privilege Compromise of Oracle EDI Gateway via HTTP
Weaknesses CWE-269

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T20:20:09.961Z

Reserved: 2026-09-28T15:40:09.489Z

Link: CVE-2026-101519

cve-icon Vulnrichment

Updated: 2026-11-06T20:19:00.650Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:01.240

Modified: 2026-11-06T21:17:04.570

Link: CVE-2026-101519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T23:00:11Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function