{"id":"CVE-2026-101689","kind":"vulnerability","aliases":["CVE-2026-101689"],"related":[],"title":"Oracle E-Business Suite: SOA Gateway flaw leaks critical data over HTTP","description":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle E-Business Suite's Integrated SOA Gateway SOA Provider component has a flaw in versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can read critical data the gateway exposes, and the scope change means other connected products can be affected too.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite Integrated SOA Gateway","fixed":[],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-erp","integrated-soa-gateway","oracle-ebs","self-hosted","vendor"],"not_affected_if":["cpu-oct2026-applied","soa-gateway-not-deployed","unknown"],"how_to_check":"Confirm your EBS release is 12.2.3 to 12.2.15 (Oracle Applications Manager > Site Map, or SELECT release_name FROM fnd_product_groups). Then check whether Integrated SOA Gateway (SOA Provider, the REST/SOAP web services at /webservices/ and /OA_HTML/ for iRepository services) is deployed and reachable. Then check whether the October 2026 CPU EBS patch is applied (adop -status, ad_bugs).","fix":"Apply the Oracle E-Business Suite patch from the October 2026 Critical Patch Update (released 2026-10-20). Patch numbers are in the EBS Patch Availability Document on My Oracle Support (login needed). Oracle's public advisory gives no fixed version number.","status":"open","published_at":"2026-10-20T22:18:23+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:10:44+00:00","updated_at":"2026-10-25T03:25:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:10:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite: SOA Gateway flaw leaks critical data over HTTP","impact":"high","summary":"Oracle E-Business Suite's Integrated SOA Gateway SOA Provider component has a flaw in versions 12.2.3 through 12.2.15. A low-privileged user with network access over HTTP can read critical data the gateway exposes, and the scope change means other connected products can be affected too.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","self-hosted","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data and affects connected products","analyst_note":"Find Oracle Critical Patch Update advisory for CVE-2026-101689 to get patched versions and checks; sources give no fix or detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Integrated SOA Gateway reachable over HTTP. Sources do not say which configurations expose the SOA Provider, so unknown whether a default install is reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3554,"output_tokens":471,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle Critical Patch Update advisory for CVE-2026-101689 to get patched versions and checks; sources give no fix or detection steps.","search":"'-101689':16A,19A '-2026':15A,18A '/av':201C '12.2.15':61B,118C '12.2.3':59B,117C '3.1':191C,200C '7.7':194C 'access':69B,128C,171C,177C,188C 'addit':158C 'affect':89B,115C 'allow':122C 'attack':125C,154C,163C 'base':192C 'busi':4A,45B,96C,106C,136C,149C,183C 'business':23A 'c/c':206C 'chang':82B,161C 'complet':176C 'compon':53B,108C 'compromis':132C 'confidenti':195C 'connect':85B 'critic':10A,74B,173C 'cve':14A,17A 'cvss':190C,197C,199C 'data':11A,75B,174C,189C 'e':3A,22A,44B,95C,105C,135C,148C,182C 'e-busi':2A,43B,94C,104C,134C,147C,181C 'e-business':21A 'easili':119C 'eb':37B 'enterpris':29B 'enterprise-erp':28B 'erp':30B 'exploit':120C 'expos':78B 'flaw':8A,56B 'gateway':7A,27A,34B,50B,77B,100C,140C,153C,187C 'h/i':207C 'host':40B 'http':13A,71B,130C 'impact':157C,196C 'integr':32B,48B,98C,138C,151C,185C 'integrated':25A 'integrated-soa-gateway':31B 'l/pr':203C 'l/ui':204C 'leak':9A 'low':64B,123C 'low-privileg':63B 'may':155C 'mean':83B 'n':209C 'n/a':208C 'n/ac':202C 'n/s':205C 'network':68B,127C 'oracl':1A,36B,42B,93C,103C,133C,146C,180C 'oracle':20A 'oracle-eb':35B 'privileg':65B,124C 'product':86B,101C,159C 'provid':52B,110C 'read':73B 'result':168C 'scope':81B,160C 'score':193C 'self':39B 'self-host':38B 'signific':156C 'soa':6A,26A,33B,49B,51B,99C,109C,139C,152C,186C 'success':162C 'suit':5A,46B,97C,107C,137C,150C,184C 'suite':24A 'support':111C 'unauthor':170C 'user':66B 'vector':198C 'vendor':41B 'version':58B,112C 'via':129C 'vulner':90C,121C,143C,166C","nicknames":[],"mitigations":[],"who_affected":"Sites running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Integrated SOA Gateway reachable over HTTP. Sources do not say which configurations expose the SOA Provider, so unknown whether a default install is reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101689","severity":null,"published_at":"2026-10-20T22:18:23+00:00","modified_at":"2026-10-22T18:17:14+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101689:715","url":null,"severity":null,"published_at":"2026-10-25T03:25:52+00:00","modified_at":"2026-10-25T03:25:52+00:00","first_seen_at":"2026-10-25T03:25:52+00:00","fetched_at":"2026-10-25T03:25:52+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists EBS 12.2.3-12.2.15 as affected; the exact patch number is in the MOS patch availability document, which needs a login, so I did not read it. No exploitation or PoC found; no discussion searched."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3165,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101689","title":"CVE Record: CVE-2026-101689 (CNA: Oracle)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}