Description
Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access and Partial Denial of Service
Action: Patch Immediately
AI Analysis

Impact

The vulnerability resides in the Install component of Oracle XML Gateway, part of Oracle E‑Business Suite, and permits an attacker with low‑privileged access and network connectivity over HTTP to bypass normal controls. Successful exploitation allows reading any data that the gateway can reach and can trigger a partial denial of service. The weakness involves insufficient validation and safeguarding of resources during request processing.

Affected Systems

Oracle XML Gateway in Oracle E‑Business Suite versions 12.2.3 through 12.2.15, deployed as the Install component within the suite.

Risk and Exploitability

The CVSS Base Score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests an extremely low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only low‑privilege credentials and network access over HTTP to the gateway; no additional prerequisites or privileged escalation steps are necessary.

Generated by OpenCVE AI on September 21, 2026 at 23:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the XML Gateway vulnerability or upgrade beyond the 12.2.15 release.
  • If a patch or upgrade is not immediately available, restrict external HTTP traffic to trusted IP addresses and enforce authentication before permitting access.
  • Monitor gateway logs for abnormal access patterns and configure firewall or network segmentation rules to isolate the gateway and limit potential impact.

Generated by OpenCVE AI on September 21, 2026 at 23:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Oracle XML Gateway Uncontrolled Resource Consumption Vulnerability

Mon, 21 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle XML Gateway
Weaknesses CWE-284

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via HTTP in Oracle XML Gateway
Weaknesses CWE-284

Fri, 18 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Low Privilege Exploitation in Oracle XML Gateway Allows Unauthorized Data Access
Weaknesses CWE-284
CWE-287

Thu, 17 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Exploitation in Oracle XML Gateway Allows Unauthorized Data Access
Weaknesses CWE-284
CWE-287

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle xml Gateway
CPEs cpe:2.3:a:oracle:xml_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle xml Gateway
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Xml Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T19:18:06.661Z

Reserved: 2026-08-31T15:40:57.354Z

Link: CVE-2026-83345

cve-icon Vulnrichment

Updated: 2026-09-21T19:18:00.892Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:47.913

Modified: 2026-09-21T20:17:34.863

Link: CVE-2026-83345

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T23:30:18Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption