Description
Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Breach
Action: Immediate Patch
AI Analysis

Impact

Oracle XML Gateway’s install component has a weakness that allows a low‑privileged attacker with network access over HTTP to gain unauthorized access to all data exposed by the gateway and may cause a partial denial of service. The flaw stems from inadequate access control (CWE‑284) and results in high confidentiality impact and low availability impact, reflected in a CVSS 3.1 base score of 7.1.

Affected Systems

Oracle XML Gateway, versions 12.2.3 through 12.2.15 are affected. The vulnerability is specific to the install component of Oracle E‑Business Suite and applies to all builds within this range.

Risk and Exploitability

The CVSS of 7.1 indicates moderate‑to‑high risk, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker only requires HTTP connectivity to the gateway; no special privileges or user interaction are needed. By sending a crafted HTTP request the attacker can retrieve sensitive data or disrupt services, but the impact is confined to the XML Gateway rather than a full system compromise.

Generated by OpenCVE AI on September 20, 2026 at 10:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Oracle XML Gateway to address this vulnerability.
  • If a patch is not yet available, restrict HTTP access to the XML Gateway using firewall rules, limiting access to trusted internal networks only.
  • Monitor HTTP traffic for abnormal requests targeting XML Gateway endpoints to detect exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 10:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle XML Gateway Install Component

Thu, 17 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle XML Gateway Install Component

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle xml Gateway
CPEs cpe:2.3:a:oracle:xml_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle xml Gateway
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Xml Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:24:38.766Z

Reserved: 2026-08-31T15:40:57.334Z

Link: CVE-2026-83044

cve-icon Vulnrichment

Updated: 2026-09-16T15:55:01.271Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:12.853

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T10:45:18Z

Weaknesses