---
id: "CVE-2026-101519"
kind: "vulnerability"
aliases: ["CVE-2026-101519"]
title: "Oracle EDI Gateway: high-privilege network attacker can take over the product"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "oracle-edi-gateway", "package", "self-hosted"]
not_affected_if: ["no-edi-gateway", "not-in-affected-range"]
published_at: "2026-10-20T22:18:01+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:29:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101519", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle EDI Gateway: high-privilege network attacker can take over the product

Oracle EDI Gateway, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, has a flaw in its miscellaneous EDI component that can be reached over HTTP. An attacker who already holds high-privilege credentials can take over the gateway, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the release, for example with the EBS version shown in Oracle Applications Manager
- Check whether the installed release falls in `12.2.3` through `12.2.15`
- Review which accounts hold high privileges in the EBS environment that can reach the EDI Gateway over HTTP

## Fix

- Apply the Oracle Critical Patch Update fix for the Oracle EDI Gateway component in Oracle E-Business Suite, moving past `12.2.15` as the sources do not name a patched build
- Review and restrict high-privilege accounts that can reach the EDI Gateway over HTTP
- Limit network exposure of the EDI Gateway HTTP endpoints to trusted partners

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101519

## From the sources

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_