---
id: "CVE-2026-101533"
kind: "vulnerability"
aliases: ["CVE-2026-101533"]
title: "Oracle EDI Gateway: high-privilege network attacker can take over the product"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["enterprise-erp", "oracle-ebs", "oracle-edi-gateway", "package"]
not_affected_if: ["edi-gateway-not-installed"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:46:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101533", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle EDI Gateway: high-privilege network attacker can take over the product

Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its miscellaneous EDI component that an attacker with high privileges can reach over HTTP. Successful exploitation can give the attacker full takeover of the gateway, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether Oracle EDI Gateway is installed in the E-Business Suite instance, using the EDI Gateway product in the Oracle E-Business Suite release.
- Confirm the release is within `12.2.3` through `12.2.15`, as stated by the source.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, moving past `12.2.15`; the exact patch is unknown from the sources.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101533

## From the sources

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_