Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Unauthorized data access and modification
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle EDI Gateway allows a low‑privileged attacker who can reach the system over HTTP to circumvent access controls and read, insert, update or delete data. The vulnerability grants high confidentiality compromise with a low integrity impact and no availability effect, as reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.

Affected Systems

Oracle Corporation’s Oracle EDI Gateway component of Oracle E‑Business Suite versions 12.2.3 through 12.2.15 are affected. The vulnerability may also influence other Oracle products linked to the gateway due to a scope change communicated by Oracle.

Risk and Exploitability

The CVSS base score of 8.5 indicates a high‑severity flaw. EPSS data are unavailable and the vulnerability is not listed in the CISA KEV catalog, but the description calls it easily exploitable via a network HTTP interface. Attackers need only network access and moderate privileges to gain unauthorized data access, so the attack path is straightforward and the risk to sensitive information is significant.

Generated by OpenCVE AI on October 21, 2026 at 00:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 update for Oracle EDI Gateway (see Oracle security alert)
  • Restrict HTTP access to Oracle EDI Gateway by limiting firewall rules to trusted IP ranges or by placing the service behind a VPN
  • Perform a security configuration review to enforce least privilege, disable unused accounts, and conduct regular audit of gateway permissions

Generated by OpenCVE AI on October 21, 2026 at 00:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle EDI Gateway
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:24.704Z

Reserved: 2026-09-28T15:40:09.490Z

Link: CVE-2026-101534

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:02.763

Modified: 2026-10-20T22:18:02.763

Link: CVE-2026-101534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:30:12Z

Weaknesses