{"id":"CVE-2026-101519","kind":"vulnerability","aliases":["CVE-2026-101519"],"related":[],"title":"Oracle EDI Gateway: high-privilege network attacker can take over the product","description":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component that can be reached over HTTP. An attacker who already holds high-privilege credentials can take over the gateway, with full confidentiality, integrity and availability impact.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","oracle-edi-gateway","package","self-hosted"],"not_affected_if":["no-edi-gateway","not-in-affected-range"],"how_to_check":"- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the release, for example with the EBS version shown in Oracle Applications Manager\n- Check whether the installed release falls in `12.2.3` through `12.2.15`\n- Review which accounts hold high privileges in the EBS environment that can reach the EDI Gateway over HTTP","fix":"- Apply the Oracle Critical Patch Update fix for the Oracle EDI Gateway component in Oracle E-Business Suite, moving past `12.2.15` as the sources do not name a patched build\n- Review and restrict high-privilege accounts that can reach the EDI Gateway over HTTP\n- Limit network exposure of the EDI Gateway HTTP endpoints to trusted partners","status":"open","published_at":"2026-10-20T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:29:20+00:00","updated_at":"2026-10-25T03:29:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for the Oracle EDI Gateway component in Oracle E-Business Suite, moving past `12.2.15` as the sources do not name a patched build\n- Review and restrict high-privilege accounts that can reach the EDI Gateway over HTTP\n- Limit network exposure of the EDI Gateway HTTP endpoints to trusted partners","reach":"network","title":"Oracle EDI Gateway: high-privilege network attacker can take over the product","impact":"high","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component that can be reached over HTTP. An attacker who already holds high-privilege credentials can take over the gateway, with full confidentiality, integrity and availability impact.","category":"package","nicknames":[],"who_cares":["oracle-ebs","oracle-edi-gateway","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Oracle EDI Gateway, reading, changing and disrupting its data","analyst_note":"Check the Oracle Security Alert or CPU advisory for the patch that fixes EDI Gateway 12.2.3-12.2.15 and confirm the patched build; sources give no fix version.","how_to_check":"- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the release, for example with the EBS version shown in Oracle Applications Manager\n- Check whether the installed release falls in `12.2.3` through `12.2.15`\n- Review which accounts hold high privileges in the EBS environment that can reach the EDI Gateway over HTTP","needs_analyst":true,"not_affected_if":["not-in-affected-range","no-edi-gateway"],"who_is_affected":"Teams running Oracle E-Business Suite with the Oracle EDI Gateway in releases 12.2.3 through 12.2.15 are exposed. The attacker must hold high privileges and reach the gateway over the network, so exposure depends on who holds those accounts and whether the HTTP endpoints are reachable from outside the trusted network. Organizations not running Oracle EDI Gateway or running releases outside that range can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":3474,"output_tokens":840,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101519':16A,19A '-2026':15A,18A '/av':151C '12.2.15':45B,106C '12.2.3':43B,105C '3.1':138C,150C '7.2':141C 'access':116C 'affect':103C 'allow':110C 'alreadi':63B 'attack':8A,61B,113C,125C 'avail':79B,145C 'base':139C 'busi':40B,92C 'compon':53B,94C 'compromis':120C 'confidenti':76B,142C 'credenti':68B 'cve':14A,17A 'cvss':137C,147C,149C 'e':39B,91C 'e-busi':38B,90C 'easili':107C 'eb':23B 'edi':2A,26B,33B,52B,85C,97C,122C,135C 'erp':20B 'exploit':108C 'flaw':48B 'full':75B 'gateway':3A,27B,34B,73B,86C,123C,136C 'h':159C 'h/a':158C 'h/i':157C 'h/ui':154C 'high':5A,66B,111C 'high-privileg':4A,65B 'hold':64B 'host':31B 'http':59B,118C 'impact':80B,146C 'integr':77B,143C 'issu':98C 'l/pr':153C 'miscellan':51B,96C 'n/ac':152C 'n/s':155C 'network':7A,115C 'oracl':1A,22B,25B,32B,37B,84C,89C,121C,134C 'oracle-eb':21B 'oracle-edi-gateway':24B 'packag':28B 'part':35B 'privileg':6A,67B,112C 'product':13A,87C 'reach':57B 'result':130C 'score':140C 'self':30B 'self-host':29B 'success':124C 'suit':41B,93C 'support':99C 'take':10A,70B 'takeov':132C 'u/c':156C 'vector':148C 'version':42B,100C 'via':117C 'vulner':81C,109C,128C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite with the Oracle EDI Gateway in releases 12.2.3 through 12.2.15 are exposed. The attacker must hold high privileges and reach the gateway over the network, so exposure depends on who holds those accounts and whether the HTTP endpoints are reachable from outside the trusted network. Organizations not running Oracle EDI Gateway or running releases outside that range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101519","severity":null,"published_at":"2026-10-20T22:18:01+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}