---
id: "CVE-2026-101532"
kind: "vulnerability"
aliases: ["CVE-2026-101532"]
title: "Oracle E-Business Suite EDI Gateway: remote takeover by a privileged user"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["edi-gateway", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["edi-gateway-not-installed", "patched-release"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:29:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101532", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite EDI Gateway: remote takeover by a privileged user

Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that lets a high-privileged user reach it over HTTP. A successful attack can take over the EDI Gateway, per the NVD description (CVSS 7.2).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the EDI Gateway is in use and note the release, for example `12.2.3` to `12.2.15` are listed as affected
- Check the patch level in Oracle E-Business Suite against the Oracle Critical Patch Update advisory for this CVE (unknown in sources)

## Fix

- Apply the Oracle Critical Patch Update fix for CVE-2026-101532 to Oracle E-Business Suite EDI Gateway (fixed version unknown in sources)
- Until patched, restrict HTTP access to the EDI Gateway to trusted networks (unknown in sources)

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101532

## From the sources

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_