Description
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-07-21
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle EDI Gateway flaw permits a low‑privileged attacker with network access via HTTP to read sensitive data that should be confidential. This is an unauthorized information disclosure vulnerability (CWE‑200) and results in a limited confidentiality loss; integrity and availability are unaffected.

Affected Systems

Oracle Corporation’s EDI Gateway product, part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15. The product must be reachable over HTTP; if restricted to trusted networks the vulnerability is mitigated.

Risk and Exploitability

The CVSS 3.1 base score of 4.3 indicates a low severity attack that only impacts confidentiality. The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of public exploitation. The attack path exploits the HTTP interface; a low‑privileged attacker can request data endpoints and retrieve a subset of data without authentication, consistent with CWE‑200.

Generated by OpenCVE AI on August 4, 2026 at 00:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle patches that address EDI Gateway versions 12.2.3 to 12.2.15.
  • Restrict inbound HTTP traffic to the EDI Gateway by using firewall rules or VPN segmentation to limit reachability to trusted networks.
  • Enable audit logging for all read operations and review logs regularly for anomalous data access patterns.

Generated by OpenCVE AI on August 4, 2026 at 00:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure in Oracle EDI Gateway

Thu, 30 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure in Oracle EDI Gateway

Mon, 27 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure in Oracle EDI Gateway

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure in Oracle EDI Gateway

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle edi Gateway
CPEs cpe:2.3:a:oracle:edi_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle edi Gateway
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Edi Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T17:57:06.203Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61316

cve-icon Vulnrichment

Updated: 2026-07-22T17:57:02.478Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor