---
id: "CVE-2026-101685"
kind: "vulnerability"
aliases: ["CVE-2026-101685"]
title: "Oracle E-Business Suite SOA Gateway: low-privileged network user can take over"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite Integrated SOA Gateway", "fixed": ["October 2026 CPU (Patch 40022426)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-erp", "oracle-ebs", "package", "self-hosted"]
not_affected_if: ["versions-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:23+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:06:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101685", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:06:11+00:00"}]
---

# Oracle E-Business Suite SOA Gateway: low-privileged network user can take over

Oracle E-Business Suite Integrated SOA Gateway (SOA Provider), 12.2.3-12.2.15: a low-privileged user with HTTP access can take over the gateway (CVSS 8.8, C/H I/H A/H). Fixed by the October 2026 Critical Patch Update. Not in CISA KEV; no public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Integrated SOA Gateway affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU (Patch 40022426)

## How to check

Check whether Integrated SOA Gateway is deployed and reachable (EBS 12.2.3-12.2.15). Confirm the Oct 2026 CPU EBS patch (Patch 40022426 per Rapid7) is applied using AD/OPatch or the EBS patch history (ad_bugs). Whether ISG must be enabled to be exposed is unknown; see Oracle's EBS patch availability document on My Oracle Support.

## Fix

Apply the Oracle E-Business Suite October 2026 Critical Patch Update (Patch 40022426 per Rapid7; confirm in Oracle's EBS patch availability doc on MOS). Until then, restrict network access to ISG/SOA Provider endpoints.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101685
- 2026-10-24T00:06:11+00:00 analyst — Oracle Oct 2026 CPU lists EBS 12.2.3-12.2.15 as affected; fix patch number from Rapid7 only (Patch 40022426), not verified on the MOS patch availability doc (login required). Prerequisite of SOA Gateway being enabled not confirmed. No exploitation or PoC found (not in KEV, EPSS 0%). Sibling CVE-2026-101688 (unauth, SOA Provider, 8.6) exists. Social search skipped.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101685 (sibling SOA Provider CVE), solution Patch 40022426 https://www.rapid7.com/db/vulnerabilities/cve-2026-101685/

## From the sources

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_