{"id":"CVE-2026-101685","kind":"vulnerability","aliases":["CVE-2026-101685"],"related":[],"title":"Oracle E-Business Suite SOA Gateway: low-privileged network user can take over","description":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite Integrated SOA Gateway (SOA Provider), 12.2.3-12.2.15: a low-privileged user with HTTP access can take over the gateway (CVSS 8.8, C/H I/H A/H). Fixed by the October 2026 Critical Patch Update. Not in CISA KEV; no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite Integrated SOA Gateway","fixed":["October 2026 CPU (Patch 40022426)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","package","self-hosted"],"not_affected_if":["versions-outside-12.2.3-12.2.15"],"how_to_check":"Check whether Integrated SOA Gateway is deployed and reachable (EBS 12.2.3-12.2.15). Confirm the Oct 2026 CPU EBS patch (Patch 40022426 per Rapid7) is applied using AD/OPatch or the EBS patch history (ad_bugs). Whether ISG must be enabled to be exposed is unknown; see Oracle's EBS patch availability document on My Oracle Support.","fix":"Apply the Oracle E-Business Suite October 2026 Critical Patch Update (Patch 40022426 per Rapid7; confirm in Oracle's EBS patch availability doc on MOS). Until then, restrict network access to ISG/SOA Provider endpoints.","status":"open","published_at":"2026-10-20T22:18:23+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:43+00:00","updated_at":"2026-10-24T00:06:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:38:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite SOA Gateway: low-privileged network user can take over","impact":"high","summary":"Oracle E-Business Suite's Integrated SOA Gateway (SOA Provider component), versions 12.2.3 through 12.2.15, has a flaw reachable over HTTP. An attacker with a low-privilege account on the network can take over the gateway, with high impact to confidentiality, integrity and availability.","category":"package","who_cares":["oracle-ebs","enterprise-erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the SOA Gateway, reading and changing ERP data","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level that fixes SOA Provider in 12.2.3-12.2.15 and whether the SOA Gateway must be enabled to be exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000517,"input_tokens":3112,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch level that fixes SOA Provider in 12.2.3-12.2.15 and whether the SOA Gateway must be enabled to be exposed.","search":"'-101685':17A,20A '-2026':16A,19A '/av':168C '12.2.15':50B,113C '12.2.3':49B,112C '2026':73B '3.1':155C,167C '8.8':65B,158C 'a/h':68B 'access':58B,123C 'affect':110C 'allow':117C 'attack':120C,137C 'avail':162C 'base':156C 'busi':4A,42B,91C,101C,131C,149C 'business':24A 'c/h':66B 'cisa':79B 'compon':103C 'compromis':127C 'confidenti':159C 'critic':74B 'cve':15A,18A 'cvss':64B,154C,164C,166C 'e':3A,23A,41B,90C,100C,130C,148C 'e-busi':2A,40B,89C,99C,129C,147C 'e-business':22A 'easili':114C 'eb':34B 'enterpris':30B 'enterprise-erp':29B 'erp':31B 'exploit':115C 'fix':69B 'found':84B 'gateway':7A,28A,46B,63B,95C,135C,153C 'h':176C 'h/a':175C 'h/i':174C 'host':38B 'http':57B,125C 'i/h':67B 'impact':163C 'integr':44B,93C,133C,151C,160C 'integrated':26A 'kev':80B 'l/pr':170C 'l/ui':171C 'low':9A,53B,118C 'low-privileg':8A,52B 'n/ac':169C 'n/s':172C 'network':11A,122C 'octob':72B 'oracl':1A,33B,39B,88C,98C,128C,146C 'oracle':21A 'oracle-eb':32B 'packag':35B 'patch':75B 'poc':83B 'privileg':10A,54B,119C 'product':96C 'provid':48B,105C 'public':82B 'result':142C 'score':157C 'self':37B 'self-host':36B 'soa':6A,27A,45B,47B,94C,104C,134C,152C 'success':136C 'suit':5A,43B,92C,102C,132C,150C 'suite':25A 'support':106C 'take':14A,60B 'takeov':144C 'u/c':173C 'updat':76B 'user':12A,55B 'vector':165C 'version':107C 'via':124C 'vulner':85C,116C,140C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101685","severity":null,"published_at":"2026-10-20T22:18:23+00:00","modified_at":"2026-10-21T21:17:36+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101685:588","url":null,"severity":null,"published_at":"2026-10-24T00:06:11+00:00","modified_at":"2026-10-24T00:06:11+00:00","first_seen_at":"2026-10-24T00:06:11+00:00","fetched_at":"2026-10-24T00:06:11+00:00","note":"Oracle Oct 2026 CPU lists EBS 12.2.3-12.2.15 as affected; fix patch number from Rapid7 only (Patch 40022426), not verified on the MOS patch availability doc (login required). Prerequisite of SOA Gateway being enabled not confirmed. No exploitation or PoC found (not in KEV, EPSS 0%). Sibling CVE-2026-101688 (unauth, SOA Provider, 8.6) exists. Social search skipped."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2352,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101685/","title":"Rapid7: CVE-2026-101685 (sibling SOA Provider CVE), solution Patch 40022426","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}