---
id: "CVE-2026-101686"
kind: "vulnerability"
aliases: ["CVE-2026-101686"]
title: "Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take over"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle E-Business Suite Integrated SOA Gateway", "fixed": ["Oct 2026 CPU (Patch 40022426:12.2.0, unconfirmed for this CVE)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cpu-oct-2026", "integrated-soa-gateway", "oracle-ebs", "package", "runtime", "self-hosted"]
not_affected_if: ["default-config", "not-internet-reachable", "soa-gateway-not-deployed"]
published_at: "2026-10-20T22:18:23+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:06:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101686", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:06:26+00:00"}]
---

# Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take over

Oracle E-Business Suite 12.2.3-12.2.15, Integrated SOA Gateway (component SOA Provider): a low-privileged user with HTTP network access can take over the gateway (CVSS 3.1 8.8, AV:N/AC:L/PR:L, C/I/A high). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Integrated SOA Gateway affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU (Patch 40022426:12.2.0, unconfirmed for this CVE)

## How to check

Run Oracle's EBS Critical Patch Update Checker (ECPUC.sql, Patch 35583866) and confirm the October 2026 CPU EBS patches are applied. Also check whether the Integrated SOA Gateway / SOA Provider REST/SOAP services are deployed and reachable over HTTP from untrusted networks.

## Fix

Apply the October 2026 EBS CPU through the EBS patch availability document in My Oracle Support (adop online patching). Rapid7 lists Patch 40022426:12.2.0 for sibling SOA Provider CVEs; confirm it covers this CVE. Until then, restrict network access to the SOA Gateway HTTP endpoints to trusted IPs.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101686
- 2026-10-24T00:06:26+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026) lists EBS 12.2.3-12.2.15 as affected; the per-CVE risk matrix and EBS patch doc were not readable, so the patch for this exact CVE is not confirmed. Rapid7 gives Patch 40022426:12.2.0 for sibling SOA Provider CVEs 101685/87/88. Armis's claim of 'fixed in 12.2.16' is not on the Oracle page, so I ignored it. No exploitation or PoC found. Whether SOA Provider endpoints must be enabled is unknown; the MOS patch doc would settle it.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101685 (sibling SOA Provider CVE), solution Patch 40022426 https://www.rapid7.com/db/vulnerabilities/cve-2026-101685/
- [mitigation] October 2026 Updates to EBS Critical Patch Update Checker (ECPUC) https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc

## From the sources

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_