{"id":"CVE-2026-101684","kind":"vulnerability","aliases":["CVE-2026-101684"],"related":[],"title":"Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users change or read data","description":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","summary":"Oracle E-Business Suite's Integrated SOA Gateway component, versions 12.2.3 through 12.2.15, has a flaw reachable over HTTP. An attacker with a low-privileged account and network access can create, modify, or delete data and read data beyond their rights, and can partly disrupt the service.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","integrated-soa-gateway","oracle-ebs","package","self-hosted"],"not_affected_if":["release-outside-12.2.3-12.2.15","soa-gateway-not-deployed"],"how_to_check":"- Check the installed E-Business Suite release level against the affected range 12.2.3 to 12.2.15 in the Oracle advisory\n- Confirm whether the Integrated SOA Gateway is deployed and reachable over HTTP\n- Review Oracle's patch list for the current release level, as the sources do not name a patch","fix":"- Apply the Oracle Critical Patch Update fix for Integrated SOA Gateway that covers your E-Business Suite release; the sources do not name the patch number\n- Restrict network access to the SOA Gateway HTTP endpoints until patched","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:02:23+00:00","updated_at":"2026-10-25T03:02:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:02:23Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Integrated SOA Gateway that covers your E-Business Suite release; the sources do not name the patch number\n- Restrict network access to the SOA Gateway HTTP endpoints until patched","reach":"internet","title":"Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users change or read data","impact":"high","summary":"Oracle E-Business Suite's Integrated SOA Gateway component, versions 12.2.3 through 12.2.15, has a flaw reachable over HTTP. An attacker with a low-privileged account and network access can create, modify, or delete data and read data beyond their rights, and can partly disrupt the service.","category":"package","nicknames":[],"who_cares":["oracle-ebs","integrated-soa-gateway","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads and changes critical ERP data, and partly disrupts service","analyst_note":"Find Oracle's Critical Patch Update advisory and patch number for SOA Gateway 12.2.3-12.2.15 to fill the fix and check fields.","how_to_check":"- Check the installed E-Business Suite release level against the affected range 12.2.3 to 12.2.15 in the Oracle advisory\n- Confirm whether the Integrated SOA Gateway is deployed and reachable over HTTP\n- Review Oracle's patch list for the current release level, as the sources do not name a patch","needs_analyst":true,"not_affected_if":["release-outside-12.2.3-12.2.15","soa-gateway-not-deployed"],"who_is_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Integrated SOA Gateway exposed over HTTP are affected. Sites on releases outside that range, or where the gateway is not deployed or reachable from the network, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":3612,"output_tokens":712,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101684':20A,23A '-2026':19A,22A '/av':223C '12.2.15':49B,113C '12.2.3':47B,112C '3.1':210C,222C '8.3':213C 'abil':190C 'access':66B,123C,149C,163C,169C,175C,186C 'account':63B 'affect':110C 'allow':117C 'attack':57B,120C,137C 'avail':217C 'base':211C 'beyond':76B 'busi':4A,39B,91C,101C,131C,158C,181C,204C 'caus':192C 'chang':14A 'complet':174C 'compon':45B,103C 'compromis':127C 'confidenti':214C 'creat':68B 'creation':145C 'critic':151C,171C 'cve':18A,21A 'cvss':209C,219C,221C 'data':17A,72B,75B,152C,164C,172C,187C 'delet':71B,146C 'denial':195C 'disrupt':82B 'dos':199C 'e':3A,38B,90C,100C,130C,157C,180C,203C 'e-busi':2A,37B,89C,99C,129C,156C,179C,202C 'easili':114C 'eb':31B 'erp':24B 'exploit':115C 'flaw':8A,52B 'gateway':7A,28B,44B,95C,135C,162C,185C,208C 'h/a':230C 'h/i':229C 'host':35B 'http':55B,125C 'impact':218C 'integr':26B,42B,93C,133C,160C,183C,206C,215C 'integrated-soa-gateway':25B 'intern':104C 'l':231C 'l/pr':225C 'l/ui':226C 'let':9A 'low':11A,61B,118C 'low-privileg':10A,60B 'modif':148C 'modifi':69B 'n/ac':224C 'n/s':227C 'network':65B,122C 'oper':105C 'oracl':1A,30B,36B,88C,98C,128C,155C,178C,201C 'oracle-eb':29B 'packag':32B 'part':81B 'partial':194C,198C 'privileg':12A,62B,119C 'product':96C 'reachabl':53B 'read':16A,74B 'result':142C 'right':78B 'score':212C 'self':34B 'self-host':33B 'servic':84B,197C 'soa':6A,27B,43B,94C,134C,161C,184C,207C 'success':136C 'suit':5A,40B,92C,102C,132C,159C,182C,205C 'support':106C 'u/c':228C 'unauthor':144C,168C,189C 'user':13A 'vector':220C 'version':46B,107C 'via':124C 'vulner':85C,116C,140C 'well':166C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Integrated SOA Gateway exposed over HTTP are affected. Sites on releases outside that range, or where the gateway is not deployed or reachable from the network, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101684","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:36+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}