{"id":"CVE-2026-101532","kind":"vulnerability","aliases":["CVE-2026-101532"],"related":[],"title":"Oracle E-Business Suite EDI Gateway: remote takeover by a privileged user","description":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that lets a high-privileged user reach it over HTTP. A successful attack can take over the EDI Gateway, per the NVD description (CVSS 7.2).","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edi-gateway","oracle-ebs","package","self-hosted"],"not_affected_if":["edi-gateway-not-installed","patched-release"],"how_to_check":"- Confirm the EDI Gateway is in use and note the release, for example `12.2.3` to `12.2.15` are listed as affected\n- Check the patch level in Oracle E-Business Suite against the Oracle Critical Patch Update advisory for this CVE (unknown in sources)","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101532 to Oracle E-Business Suite EDI Gateway (fixed version unknown in sources)\n- Until patched, restrict HTTP access to the EDI Gateway to trusted networks (unknown in sources)","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:29:18+00:00","updated_at":"2026-10-25T03:29:18+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:29:18Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-101532 to Oracle E-Business Suite EDI Gateway (fixed version unknown in sources)\n- Until patched, restrict HTTP access to the EDI Gateway to trusted networks (unknown in sources)","reach":"network","title":"Oracle E-Business Suite EDI Gateway: remote takeover by a privileged user","impact":"high","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that lets a high-privileged user reach it over HTTP. A successful attack can take over the EDI Gateway, per the NVD description (CVSS 7.2).","category":"package","nicknames":[],"who_cares":["oracle-ebs","edi-gateway","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker takes over the EDI Gateway, reading and changing its data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101532 to confirm the fixed release and any workaround; the NVD entry alone gives no fix.","how_to_check":"- Confirm the EDI Gateway is in use and note the release, for example `12.2.3` to `12.2.15` are listed as affected\n- Check the patch level in Oracle E-Business Suite against the Oracle Critical Patch Update advisory for this CVE (unknown in sources)","needs_analyst":true,"not_affected_if":["edi-gateway-not-installed","patched-release"],"who_is_affected":"Organizations running Oracle E-Business Suite with the EDI Gateway in releases 12.2.3 through 12.2.15 that expose the gateway over HTTP. The attacker needs high privileges, so teams without the EDI Gateway or on patched releases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3474,"output_tokens":685,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101532':16A,19A '-2026':15A,18A '/av':144C '12.2.15':99C '12.2.3':98C '3.1':131C,143C '7.2':73B,134C 'access':109C 'affect':96C 'allow':103C 'attack':61B,106C,118C 'avail':138C 'base':132C 'busi':4A,38B,85C 'compon':47B,87C 'compromis':113C 'confidenti':135C 'cve':14A,17A 'cvss':72B,130C,140C,142C 'descript':71B 'e':3A,37B,84C 'e-busi':2A,36B,83C 'easili':100C 'eb':25B 'edi':6A,21B,31B,46B,66B,78C,90C,115C,128C 'edi-gateway':20B 'exploit':101C 'flaw':42B 'gateway':7A,22B,32B,67B,79C,116C,129C 'h':152C 'h/a':151C 'h/i':150C 'h/ui':147C 'high':52B,104C 'high-privileg':51B 'host':29B 'http':58B,111C 'impact':139C 'integr':136C 'issu':91C 'l/pr':146C 'let':49B 'miscellan':45B,89C 'n/ac':145C 'n/s':148C 'network':108C 'nvd':70B 'oracl':1A,24B,30B,35B,77C,82C,114C,127C 'oracle-eb':23B 'packag':26B 'part':33B 'per':68B 'privileg':12A,53B,105C 'product':80C 'reach':55B 'remot':8A 'result':123C 'score':133C 'self':28B 'self-host':27B 'success':60B,117C 'suit':5A,39B,86C 'support':92C 'take':63B 'takeov':9A,125C 'u/c':149C 'user':13A,54B 'vector':141C 'version':93C 'via':110C 'vulner':74C,102C,121C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite with the EDI Gateway in releases 12.2.3 through 12.2.15 that expose the gateway over HTTP. The attacker needs high privileges, so teams without the EDI Gateway or on patched releases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101532","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}