Description
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Oracle E‑Business Suite Integrated SOA Gateway, specifically the SOA Provider component, permits a low‑privileged attacker with HTTP network access to obtain unauthorized access to the gateway’s data. This vulnerability can lead to full disclosure of critical data and potentially complete access to all data exposed through the gateway. The weakness is classified as improper access control, allowing confidentiality compromise while leaving integrity and availability unaffected.

Affected Systems

Oracle Corporation’s Oracle E‑Business Suite Integrated SOA Gateway, versions 12.2.3 through 12.2.15, are affected. Because the vulnerability includes a scope change, other Oracle E‑Business Suite products that interface with the gateway may also experience elevated risk.

Risk and Exploitability

The CVSS 3.1 base score of 7.7 indicates a high impact on confidentiality when the attack vector is a network connection over HTTP with low attacker privileges. The EPSS score is not available, so the current likely exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the scope change and high confidentiality impact warrant immediate containment and remediation.

Generated by OpenCVE AI on October 21, 2026 at 03:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 security patch to upgrade the Integrated SOA Gateway to a fixed version.
  • Restrict inbound HTTP traffic to the SOA Gateway to trusted IP ranges or subnet ranges using firewall or network segmentation.
  • If the Integrated SOA Gateway is not required for business operations, consider disabling or uninstalling the component.
  • Monitor system and audit logs for anomalous access patterns and verify that no unauthorized data is exfiltrated.

Generated by OpenCVE AI on October 21, 2026 at 03:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle E‑Business Suite Integrated SOA Gateway
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle e-business Suite Integrated Soa Gateway
CPEs cpe:2.3:a:oracle:e-business_suite_integrated_soa_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle e-business Suite Integrated Soa Gateway
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle E-business Suite Integrated Soa Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:47:46.333Z

Reserved: 2026-09-28T15:40:09.500Z

Link: CVE-2026-101689

cve-icon Vulnrichment

Updated: 2026-10-22T17:42:54.177Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:23.500

Modified: 2026-10-22T18:17:14.613

Link: CVE-2026-101689

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses