Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Oracle EDI Gateway component "All Miscellaneous EDI Issues". An untrusted user with network access to the gateway over HTTP can exploit a logic flaw that allows a high‑privileged attacker to compromise the gateway, potentially resulting in a full system takeover. The flaw satisfies CWE-284 (Improper Access Control) and CWE-287 (Improper Verification of Cryptographic Credentials) and can lead to loss of confidentiality, integrity, and availability of the gateway.

Affected Systems

Oracle EDI Gateway, versions 12.2.3 through 12.2.15 as specified by Oracle.

Risk and Exploitability

The CVSS Base Score of 6.6 indicates moderate severity. Because the vulnerability requires a high‑privileged attacker with direct HTTP access to the gateway, the likelihood of remote exploitation depends on how the gateway is exposed to the network. EPSS score is less than 1%; the issue is not listed in the CISA KEV catalog. Environments that expose the gateway to untrusted networks face a higher risk, and the attack vector is inferred to be network‑based HTTP traffic reaching the gateway endpoint.

Generated by OpenCVE AI on October 22, 2026 at 10:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply vendor patch or upgrade Oracle EDI Gateway to a version that includes the fix.
  • Restrict HTTP access to the gateway using firewall rules, VPNs, or VLAN segmentation so only trusted internal hosts can reach it.
  • Enable detailed audit logging on the gateway and monitor for anomalous access patterns to detect potential exploitation early.

Generated by OpenCVE AI on October 22, 2026 at 10:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Oracle EDI Gateway Privilege Escalation via HTTP
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T20:22:09.151Z

Reserved: 2026-09-28T15:40:09.490Z

Link: CVE-2026-101533

cve-icon Vulnrichment

Updated: 2026-11-06T20:21:33.659Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:02.643

Modified: 2026-11-06T21:17:05.003

Link: CVE-2026-101533

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:15:13Z

Weaknesses