Description
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
Published: 2026-10-20
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and partial denial of service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Internal Operations component of the Oracle E-Business Suite Integrated SOA Gateway and allows a low privileged attacker with network access over HTTP to create, delete or modify critical data and to cause a partial denial of service. This weakness corresponds to CWE-284 (Access Control).

Affected Systems

The affected product is Oracle E-Business Suite Integrated SOA Gateway, version range 12.2.3 through 12.2.15, as supplied by Oracle Corporation. No other vendors or products are listed.

Risk and Exploitability

The CVSS 3.1 base score of 8.3 indicates high severity, and the EPSS score is not available, so the exploitation probability is unknown but the resource demands are low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network‑based HTTP request that a low‑privileged user can exploit to gain unauthorized data access or disruption. The risk to confidentiality, integrity, and availability is significant for any organization running the affected Oracle E-Business Suite components.

Generated by OpenCVE AI on October 21, 2026 at 03:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch or upgrade Oracle E‑Business Suite Integrated SOA Gateway to a version that addresses this issue.
  • Restrict HTTP access to the SOA Gateway to trusted internal networks and enforce least‑privilege for user accounts interacting with the gateway.
  • Disable or limit low‑privileged accounts from accessing the SOAP/REST endpoints; enforce proper authentication and authorization controls.
  • Monitor authentication logs and audit events for unauthorized creation, deletion or modification attempts and set up alerts for data changes and repeated failed access attempts.

Generated by OpenCVE AI on October 21, 2026 at 03:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Remote API Access Control Bypass Leading to Data Modification and Partial DoS in Oracle E-Business Suite SOA Gateway
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
First Time appeared Oracle
Oracle e-business Suite Integrated Soa Gateway
CPEs cpe:2.3:a:oracle:e-business_suite_integrated_soa_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle e-business Suite Integrated Soa Gateway
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Oracle E-business Suite Integrated Soa Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:55:40.181Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101684

cve-icon Vulnrichment

Updated: 2026-10-21T19:07:09.615Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:22.923

Modified: 2026-10-27T04:17:36.870

Link: CVE-2026-101684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:15:07Z

Weaknesses