{"id":"CVE-2026-101533","kind":"vulnerability","aliases":["CVE-2026-101533"],"related":[],"title":"Oracle EDI Gateway: high-privilege network attacker can take over the product","description":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that an attacker with high privileges can reach over HTTP. Successful exploitation can give the attacker full takeover of the gateway, with high confidentiality, integrity and availability impact.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","oracle-edi-gateway","package"],"not_affected_if":["edi-gateway-not-installed"],"how_to_check":"- Check whether Oracle EDI Gateway is installed in the E-Business Suite instance, using the EDI Gateway product in the Oracle E-Business Suite release.\n- Confirm the release is within `12.2.3` through `12.2.15`, as stated by the source.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, moving past `12.2.15`; the exact patch is unknown from the sources.","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:46:57+00:00","updated_at":"2026-10-25T03:46:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:46:57Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, moving past `12.2.15`; the exact patch is unknown from the sources.","reach":"network","title":"Oracle EDI Gateway: high-privilege network attacker can take over the product","impact":"high","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that an attacker with high privileges can reach over HTTP. Successful exploitation can give the attacker full takeover of the gateway, with high confidentiality, integrity and availability impact.","category":"package","nicknames":[],"who_cares":["oracle-ebs","oracle-edi-gateway","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the EDI Gateway with high privileges","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-101533 to confirm the fixed patch and the exact affected release list; the sources only give the NVD entry.","how_to_check":"- Check whether Oracle EDI Gateway is installed in the E-Business Suite instance, using the EDI Gateway product in the Oracle E-Business Suite release.\n- Confirm the release is within `12.2.3` through `12.2.15`, as stated by the source.","needs_analyst":true,"not_affected_if":["edi-gateway-not-installed"],"who_is_affected":"Organisations running Oracle E-Business Suite with the Oracle EDI Gateway product in the `12.2.3` to `12.2.15` range. Exposure depends on whether the EDI Gateway is deployed and reachable over HTTP by users holding high privileges. Teams not running Oracle EDI Gateway can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3476,"output_tokens":668,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101533':16A,19A '-2026':15A,18A '/av':148C '12.2.15':102C '12.2.3':101C '3.1':135C,147C '6.6':138C 'access':113C 'affect':99C 'allow':107C 'attack':8A,51B,64B,110C,122C 'avail':75B,142C 'base':136C 'busi':39B,88C 'compon':48B,90C 'compromis':117C 'confidenti':72B,139C 'cve':14A,17A 'cvss':134C,144C,146C 'difficult':103C 'e':38B,87C 'e-busi':37B,86C 'eb':25B 'edi':2A,28B,32B,47B,81C,93C,119C,132C 'enterpris':21B 'enterprise-erp':20B 'erp':22B 'exploit':60B,105C 'flaw':43B 'full':65B 'gateway':3A,29B,33B,69B,82C,120C,133C 'give':62B 'h':156C 'h/a':155C 'h/i':154C 'h/pr':150C 'h/ui':151C 'high':5A,53B,71B,108C 'high-privileg':4A 'http':58B,115C 'impact':76B,143C 'integr':73B,140C 'issu':94C 'miscellan':46B,92C 'n/ac':149C 'n/s':152C 'network':7A,112C 'oracl':1A,24B,27B,31B,36B,80C,85C,118C,131C 'oracle-eb':23B 'oracle-edi-gateway':26B 'packag':30B 'part':34B 'privileg':6A,54B,109C 'product':13A,83C 'reach':56B 'result':127C 'score':137C 'success':59B,121C 'suit':40B,89C 'support':95C 'take':10A 'takeov':66B,129C 'u/c':153C 'vector':145C 'version':96C 'via':114C 'vulner':77C,106C,125C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite with the Oracle EDI Gateway product in the `12.2.3` to `12.2.15` range. Exposure depends on whether the EDI Gateway is deployed and reachable over HTTP by users holding high privileges. Teams not running Oracle EDI Gateway can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101533","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}