{"id":"CVE-2026-101687","kind":"vulnerability","aliases":["CVE-2026-101687"],"related":[],"title":"Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take over","description":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite's Integrated SOA Gateway (SOA Provider component) contains a flaw in versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can compromise the gateway and take it over.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","self-hosted","vendor"],"not_affected_if":["gateway-not-deployed","unsupported-version-outside-range"],"how_to_check":"- Confirm the E-Business Suite release in use, looking for `12.2.3` through `12.2.15` in the installed version\n- Check whether the Integrated SOA Gateway is deployed and reachable over HTTP","fix":"- Apply the Oracle Critical Patch Update fix for the affected E-Business Suite release; the exact patch is unknown from the sources\n- Move to a supported release later than `12.2.15` if one is available; exact target version unknown","status":"open","published_at":"2026-10-20T22:18:23+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:19:12+00:00","updated_at":"2026-10-25T03:19:12+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:19:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for the affected E-Business Suite release; the exact patch is unknown from the sources\n- Move to a supported release later than `12.2.15` if one is available; exact target version unknown","reach":"network","title":"Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take over","impact":"high","summary":"Oracle E-Business Suite's Integrated SOA Gateway (SOA Provider component) contains a flaw in versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can compromise the gateway and take it over.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","self-hosted","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the SOA Gateway, reading and changing its data","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch name and whether the SOA Provider flaw is exploited; sources give no fix or detection steps.","how_to_check":"- Confirm the E-Business Suite release in use, looking for `12.2.3` through `12.2.15` in the installed version\n- Check whether the Integrated SOA Gateway is deployed and reachable over HTTP","needs_analyst":true,"not_affected_if":["unsupported-version-outside-range","gateway-not-deployed"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Integrated SOA Gateway reachable over HTTP. Exposure depends on whether the gateway's SOA Provider endpoints are accessible from the network and whether low-privileged accounts exist. Installations on other releases are not named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":3497,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101687':17A,20A '-2026':16A,19A '/av':151C '12.2.15':50B,95C '12.2.3':48B,94C '3.1':138C,150C '7.5':141C 'access':58B,106C 'affect':92C 'allow':100C 'attack':55B,103C,120C 'avail':145C 'base':139C 'busi':4A,34B,73C,83C,114C,132C 'compon':42B,85C 'compromis':62B,110C 'confidenti':142C 'contain':43B 'cve':15A,18A 'cvss':137C,147C,149C 'difficult':96C 'e':3A,33B,72C,82C,113C,131C 'e-busi':2A,32B,71C,81C,112C,130C 'eb':26B 'enterpris':22B 'enterprise-erp':21B 'erp':23B 'exploit':98C 'flaw':8A,45B 'gateway':7A,39B,64B,77C,118C,136C 'h':159C 'h/a':158C 'h/i':157C 'h/pr':153C 'host':29B 'http':60B,108C 'impact':146C 'integr':37B,75C,116C,134C,143C 'l/ui':154C 'let':9A 'low':11A,53B,101C 'low-privileg':10A,52B 'n/ac':152C 'n/s':155C 'network':57B,105C 'oracl':1A,25B,31B,70C,80C,111C,129C 'oracle-eb':24B 'privileg':12A,54B,102C 'product':78C 'provid':41B,87C 'result':125C 'score':140C 'self':28B 'self-host':27B 'soa':6A,38B,40B,76C,86C,117C,135C 'success':119C 'suit':5A,35B,74C,84C,115C,133C 'support':88C 'take':14A,66B 'takeov':127C 'u/c':156C 'user':13A 'vector':148C 'vendor':30B 'version':47B,89C 'via':107C 'vulner':67C,99C,123C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Integrated SOA Gateway reachable over HTTP. Exposure depends on whether the gateway's SOA Provider endpoints are accessible from the network and whether low-privileged accounts exist. Installations on other releases are not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101687","severity":null,"published_at":"2026-10-20T22:18:23+00:00","modified_at":"2026-10-21T21:17:36+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}