---
id: "CVE-2026-101466"
kind: "vulnerability"
aliases: ["CVE-2026-101466"]
title: "Oracle EDI Gateway in E-Business Suite: network takeover by privileged user"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["edi", "erp", "oracle-ebs", "vendor"]
not_affected_if: ["edi-gateway-not-deployed"]
published_at: "2026-10-20T22:17:55+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T03:29:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101466", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle EDI Gateway in E-Business Suite: network takeover by privileged user

Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component. An attacker who already holds a high-privilege account and can reach the service over HTTP can take over the EDI Gateway.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Oracle EDI Gateway is installed in Oracle E-Business Suite and note the release, for example with `unknown` from the sources
- Check that the E-Business Suite release is outside `12.2.3` through `12.2.15`
- unknown

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, using the version named in Oracle's advisory (unknown from the sources)
- unknown

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101466

## From the sources

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_