Description
Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access and Partial Denial of Service
Action: Patch Immediately
AI Analysis

Impact

Vulnerability in Oracle XML Gateway enables a low-privileged attacker who can reach the service over HTTP to obtain unauthorized access to critical data or full data exposed by the gateway, and to trigger a partial denial of service. The flaw is exploitable with minimal effort, requiring only network connectivity to the gateway endpoint and no special credentials. The CVSS vector indicates a high confidentiality impact and a low availability impact with a base score of 7.1.

Affected Systems

Oracle XML Gateway in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected. The vulnerability exists specifically in the Install component of the product. Systems running any of these versions with the gateway exposed to the network are at risk.

Risk and Exploitability

The attack vector is via the HTTP interface of the XML Gateway, so an attacker only needs to reach the gateway’s network port. While the EPSS score is < 1 %, indicating a low current exploitation probability, the CVSS 7.1 score and the high confidentiality impact mean that the vulnerability is still significant. The flaw is not listed in the CISA KEV catalog, but organizations should consider it a moderate-to-high risk until mitigated. If an effective patch or configuration change is applied, the risk is eliminated.

Generated by OpenCVE AI on September 20, 2026 at 07:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch or update for XML Gateway as detailed in the security alert at https://www.oracle.com/security-alerts/cspusep2026.html.
  • Restrict HTTP access to the XML Gateway service to trusted networks or hosts using firewall rules or gateway ACLs.
  • If a patch cannot be applied immediately, disable the XML Gateway service or isolate the endpoint from exposed networks until remediation can be performed.

Generated by OpenCVE AI on September 20, 2026 at 07:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Attack Enables Unauthorized Access and Partial DoS in Oracle XML Gateway
Weaknesses CWE-200
CWE-863

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Oracle XML Gateway Access Control Flaw Allowing Data Leakage and Partial Denial of Service
Weaknesses CWE-284

Wed, 16 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Oracle XML Gateway Access Control Flaw Allowing Data Leakage and Partial Denial of Service
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle XML Gateway. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle xml Gateway
CPEs cpe:2.3:a:oracle:xml_gateway:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle xml Gateway
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Xml Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-22T14:03:56.621Z

Reserved: 2026-08-31T15:40:57.354Z

Link: CVE-2026-83352

cve-icon Vulnrichment

Updated: 2026-09-22T14:03:53.781Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:48.690

Modified: 2026-09-22T15:17:17.403

Link: CVE-2026-83352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T08:00:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-863

    Incorrect Authorization