Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

An Oracle EDI Gateway vulnerability permits an attacker with network access over HTTP to gain high‑privilege control of the gateway. The flaw enables an attacker to read, modify, or delete data and disrupt integrated business processes. The vulnerability is rated a CVSS 3.1 base score of 7.2, indicating substantial confidentiality, integrity, and availability impact.

Affected Systems

The affected product is Oracle EDI Gateway, part of Oracle E‑Business Suite, with vulnerable versions 12.2.3 through 12.2.15. No other Oracle products or versions are reported as impacted by this CVE.

Risk and Exploitability

The vulnerability is remotely exploitable without authentication, requiring only HTTP traffic. The EPSS score of less than 1% indicates a low probability of exploitation observed in the wild, and the flaw is not listed in the CISA KEV catalog. Nonetheless, the potential for a full gateway takeover presents a significant risk, especially in environments where network segmentation and strict access controls are not enforced.

Generated by OpenCVE AI on November 6, 2026 at 22:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch that addresses CVE-2026-101532 as soon as it becomes available.
  • Restrict inbound HTTP traffic to Oracle EDI Gateway to approved IP ranges or VPN connections.
  • Monitor gateway logs for unauthorized authentication attempts, configuration changes, or anomalous network activity.

Generated by OpenCVE AI on November 6, 2026 at 22:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title High-Privilege Takeover via HTTP in Oracle EDI Gateway

Fri, 06 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title High-Privilege Takeover via HTTP in Oracle EDI Gateway
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T20:15:33.807Z

Reserved: 2026-09-28T15:40:09.490Z

Link: CVE-2026-101532

cve-icon Vulnrichment

Updated: 2026-11-06T20:14:41.695Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:02.527

Modified: 2026-11-06T21:17:04.840

Link: CVE-2026-101532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T23:00:11Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function