{"id":"CVE-2026-101534","kind":"vulnerability","aliases":["CVE-2026-101534"],"related":[],"title":"Oracle E-Business Suite EDI Gateway: low-privileged HTTP flaw exposes critical data","description":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its EDI component that lets a low-privileged user reach it over HTTP. A successful attack can read critical data and change or delete some data, and it can affect other products as well.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edi-gateway","enterprise-erp","oracle-ebs","vendor"],"not_affected_if":["edi-gateway-not-deployed"],"how_to_check":"- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the version, for example with `unknown` if the sources do not say how to read it.\n- Check whether the version is in the range 12.2.3 to 12.2.15 per the NVD entry.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, fixed release unknown from the sources.\n- Restrict HTTP access to the EDI Gateway to trusted networks until patched.","status":"open","published_at":"2026-10-20T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:00:27+00:00","updated_at":"2026-10-25T03:00:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:00:27Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, fixed release unknown from the sources.\n- Restrict HTTP access to the EDI Gateway to trusted networks until patched.","reach":"internet","title":"Oracle E-Business Suite EDI Gateway: low-privileged HTTP flaw exposes critical data","impact":"high","summary":"Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its EDI component that lets a low-privileged user reach it over HTTP. A successful attack can read critical data and change or delete some data, and it can affect other products as well.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","edi-gateway","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data and alters some records in EDI Gateway","analyst_note":"Find Oracle's advisory and patch number for EDI Gateway 12.2.3-12.2.15 and confirm the fixed release and any detection steps.","how_to_check":"- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the version, for example with `unknown` if the sources do not say how to read it.\n- Check whether the version is in the range 12.2.3 to 12.2.15 per the NVD entry.","needs_analyst":true,"not_affected_if":["edi-gateway-not-deployed"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the EDI Gateway component exposed over HTTP. Teams without EDI Gateway deployed or on versions outside that range can likely skip it, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3539,"output_tokens":659,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101534':18A,21A '-2026':17A,20A '/av':190C '12.2.15':103C '12.2.3':102C '3.1':178C,189C '8.5':181C 'access':113C,146C,152C,158C,168C,175C 'addit':133C 'affect':76B,100C 'allow':107C 'attack':62B,110C,129C,138C 'base':179C 'busi':4A,40B,92C 'c/c':195C 'chang':68B,136C 'complet':151C 'compon':48B,94C 'compromis':117C 'confidenti':182C 'critic':14A,65B,148C 'cve':16A,19A 'cvss':177C,186C,188C 'data':15A,66B,72B,149C,159C,176C 'delet':70B,167C 'e':3A,39B,91C 'e-busi':2A,38B,90C 'easili':104C 'eb':30B 'edi':6A,23B,33B,47B,85C,95C,119C,127C,156C,173C 'edi-gateway':22B 'enterpris':26B 'enterprise-erp':25B 'erp':27B 'exploit':105C 'expos':13A 'flaw':12A,44B 'gateway':7A,24B,34B,86C,120C,128C,157C,174C 'h/i':196C 'http':11A,59B,115C 'impact':132C,185C 'insert':165C 'integr':184C 'l/a':197C 'l/pr':192C 'l/ui':193C 'let':50B 'low':9A,53B,108C 'low-privileg':8A,52B 'may':130C 'n':198C 'n/ac':191C 'n/s':194C 'network':112C 'oracl':1A,29B,32B,37B,84C,89C,118C,126C,155C,172C 'oracle-eb':28B 'part':35B 'privileg':10A,54B,109C 'product':78B,87C,134C 'reach':56B 'read':64B 'result':143C 'scope':135C 'score':180C 'signific':131C 'success':61B,137C 'suit':5A,41B,93C 'support':96C 'unauthor':145C,163C 'updat':164C 'user':55B 'vector':187C 'vendor':31B 'version':97C 'via':114C 'vulner':81C,106C,123C,141C 'well':80B,161C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the EDI Gateway component exposed over HTTP. Teams without EDI Gateway deployed or on versions outside that range can likely skip it, though the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101534","severity":null,"published_at":"2026-10-20T22:18:02+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}