Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker who can reach the Oracle EDI Gateway over HTTP can exploit a flaw in the E-Business Suite’s EDI component. The vulnerability, rated CVSS 8.1, enables complete compromise of confidentiality, integrity, and availability, allowing the attacker to take control of the gateway and its data flows.

Affected Systems

The Oracle EDI Gateway component of Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected. Users deploying any of these releases need to verify whether the gateway is exposed to external networks.

Risk and Exploitability

The attack vector is network-based; the attacker requires only HTTP access and no user interaction. The high attack complexity reduces the likelihood of successful exploitation, and the EPSS score of less than 1% indicates a low probability of real‑world attacks. The vulnerability is not listed in CISA KEV, but its potential to expose the gateway to remote code execution remains a significant risk for exposed instances.

Generated by OpenCVE AI on August 4, 2026 at 02:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle’s July 2026 CPU advisory for applicable patches and apply any provided fixes to Oracle EDI Gateway.
  • Limit inbound HTTP traffic to the gateway to trusted internal networks or approved IP ranges by configuring firewalls or ACLs.
  • Ensure that all administrative interfaces require authentication and use secure communication protocols; consider implementing additional authentication controls to mitigate missing authentication weaknesses.

Generated by OpenCVE AI on August 4, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle EDI Gateway

Thu, 30 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle EDI Gateway

Tue, 28 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Compromise of Oracle EDI Gateway via HTTP
Weaknesses CWE-306

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Compromise of Oracle EDI Gateway via HTTP
Weaknesses CWE-284
CWE-306

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:22:48.553Z

Reserved: 2026-07-08T15:51:55.587Z

Link: CVE-2026-60756

cve-icon Vulnrichment

Updated: 2026-07-24T15:04:31.365Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:00:02Z

Weaknesses