Description
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the SOA Provider component of Oracle E‑Business Suite Integrated SOA Gateway and permits remote attackers with no administrative privileges to gain code execution or fully compromise the service. Successful exploitation results in complete control of the gateway, jeopardizing all data processed by it and disrupting service availability. The assertion that the attacker does not need administrative privileges is inferred from the mention of low privileged attacker in the description.

Affected Systems

Oracle Corporation’s Oracle E‑Business Suite Integrated SOA Gateway product is affected across supported versions 12.2.3 through 12.2.15. The vulnerability specifically targets the SOA Provider component of this suite.

Risk and Exploitability

The vulnerability has a CVSS v3.1 base score of 8.8, indicating severe confidentiality, integrity, and availability impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVE description states the vulnerability is easily exploitable by an attacker with low‑privileged network access over HTTP. The lack of an EPSS score is inferred from its absence in the provided data.

Generated by OpenCVE AI on October 21, 2026 at 04:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the October 2026 CPU for Oracle E‑Business Suite Integrated SOA Gateway.
  • If a patch is not yet available, limit HTTP access to the SOA Gateway by configuring firewall rules or network segmentation to allow only trusted internal hosts.
  • Enforce authentication and restrict gateway access to authorized users only.

Generated by OpenCVE AI on October 21, 2026 at 04:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle e-business Suite Integrated Soa Gateway
CPEs cpe:2.3:a:oracle:e-business_suite_integrated_soa_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle e-business Suite Integrated Soa Gateway
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle E-business Suite Integrated Soa Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:55:37.191Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101685

cve-icon Vulnrichment

Updated: 2026-10-21T19:07:11.300Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:23.043

Modified: 2026-10-24T04:18:13.177

Link: CVE-2026-101685

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control