{"id":"CVE-2026-101466","kind":"vulnerability","aliases":["CVE-2026-101466"],"related":[],"title":"Oracle EDI Gateway in E-Business Suite: network takeover by privileged user","description":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component. An attacker who already holds a high-privilege account and can reach the service over HTTP can take over the EDI Gateway.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edi","erp","oracle-ebs","vendor"],"not_affected_if":["edi-gateway-not-deployed"],"how_to_check":"- Confirm whether Oracle EDI Gateway is installed in Oracle E-Business Suite and note the release, for example with `unknown` from the sources\n- Check that the E-Business Suite release is outside `12.2.3` through `12.2.15`\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, using the version named in Oracle's advisory (unknown from the sources)\n- unknown","status":"open","published_at":"2026-10-20T22:17:55+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T03:29:20+00:00","updated_at":"2026-10-25T03:29:20+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, using the version named in Oracle's advisory (unknown from the sources)\n- unknown","reach":"internet","title":"Oracle EDI Gateway in E-Business Suite: network takeover by privileged user","impact":"high","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component. An attacker who already holds a high-privilege account and can reach the service over HTTP can take over the EDI Gateway.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","erp","edi"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the EDI Gateway, reading and changing its data","analyst_note":"Fetch Oracle's Critical Patch Update advisory for the exact patch and check steps; the NVD entry gives only the CVSS vector and affected range.","how_to_check":"- Confirm whether Oracle EDI Gateway is installed in Oracle E-Business Suite and note the release, for example with `unknown` from the sources\n- Check that the E-Business Suite release is outside `12.2.3` through `12.2.15`\n- unknown","needs_analyst":true,"not_affected_if":["edi-gateway-not-deployed"],"who_is_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle EDI Gateway product deployed and reachable over HTTP. The sources do not say whether the flaw is reachable without the EDI Gateway being in use, so teams without EDI Gateway can likely skip it, but this is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":3474,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101466':16A,19A '-2026':15A,18A '/av':141C '12.2.15':39B,96C '12.2.3':37B,95C '3.1':128C,140C '7.2':131C 'access':106C 'account':57B 'affect':93C 'allow':100C 'alreadi':51B 'attack':49B,103C,115C 'avail':135C 'base':129C 'busi':7A,34B,82C 'compon':47B,84C 'compromis':110C 'confidenti':132C 'cve':14A,17A 'cvss':127C,137C,139C 'e':6A,33B,81C 'e-busi':5A,32B,80C 'easili':97C 'eb':24B 'edi':2A,20B,27B,46B,69B,75C,87C,112C,125C 'erp':21B 'exploit':98C 'flaw':42B 'gateway':3A,28B,70B,76C,113C,126C 'h':149C 'h/a':148C 'h/i':147C 'h/ui':144C 'high':55B,101C 'high-privileg':54B 'hold':52B 'http':64B,108C 'impact':136C 'integr':133C 'issu':88C 'l/pr':143C 'miscellan':45B,86C 'n/ac':142C 'n/s':145C 'network':9A,105C 'oracl':1A,23B,26B,31B,74C,79C,111C,124C 'oracle-eb':22B 'part':29B 'privileg':12A,56B,102C 'product':77C 'reach':60B 'result':120C 'score':130C 'servic':62B 'success':114C 'suit':8A,35B,83C 'support':89C 'take':66B 'takeov':10A,122C 'u/c':146C 'user':13A 'vector':138C 'vendor':25B 'version':36B,90C 'via':107C 'vulner':71C,99C,118C","nicknames":[],"mitigations":[],"who_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle EDI Gateway product deployed and reachable over HTTP. The sources do not say whether the flaw is reachable without the EDI Gateway being in use, so teams without EDI Gateway can likely skip it, but this is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101466","severity":null,"published_at":"2026-10-20T22:17:55+00:00","modified_at":"2026-10-21T19:16:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}