---
id: "CVE-2026-101534"
kind: "vulnerability"
aliases: ["CVE-2026-101534"]
title: "Oracle E-Business Suite EDI Gateway: low-privileged HTTP flaw exposes critical data"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["edi-gateway", "enterprise-erp", "oracle-ebs", "vendor"]
not_affected_if: ["edi-gateway-not-deployed"]
published_at: "2026-10-20T22:18:02+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:00:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101534", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle E-Business Suite EDI Gateway: low-privileged HTTP flaw exposes critical data

Oracle EDI Gateway, part of Oracle E-Business Suite, has a flaw in its EDI component that lets a low-privileged user reach it over HTTP. A successful attack can read critical data and change or delete some data, and it can affect other products as well.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Oracle EDI Gateway is installed as part of Oracle E-Business Suite and note the version, for example with `unknown` if the sources do not say how to read it.
- Check whether the version is in the range 12.2.3 to 12.2.15 per the NVD entry.

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle E-Business Suite EDI Gateway, fixed release unknown from the sources.
- Restrict HTTP access to the EDI Gateway to trusted networks until patched.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101534

## From the sources

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_