Oracle EDI Gateway CVE-2026-101466

Exploitation requires the attacker to already possess a HIGH-privileged account on Oracle EDI Gateway (PR:H) and network reachability to the EDI Gateway application over HTTP. Affected deployments are Oracle EDI Gateway versions 12.2.3 through 12.2.15 within Oracle E-Business Suite. The attack needs no user interaction and is low-complexity, but the high-privilege prerequisite is the key limiting factor: it is not remotely exploitable by an unauthenticated or low-privileged attacker, so realistic risk is confined to trusted/elevated EDI Gateway operators or adversaries who have already compromised such credentials. No special non-default feature toggle is named in the description beyond the component itself.

This is a genuine but conditional priority. The CVSS 3.1 base score is 7.2 (High), driven by a network attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with an unchanged scope (S:U). The single most important mitigating factor is PR:H - exploitation requires an already high-privileged account on Oracle EDI Gateway, which sharply narrows the realistic attacker set to insiders or adversaries who have already obtained elevated EBS credentials. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. The input Tags label this 'Information Disclosure,' but this conflicts with the CVSS vector and Oracle's own text, which describe full 'takeover' (C:H/I:H/A:H) - the impact is far broader than mere information disclosure; treat the tag as inaccurate and rely on the vector. In summary: a legitimately high-severity flaw, but the PR:H requirement and absence of KEV/POC/EPSS signals place it as an important patch-cycle item rather than an emergency, unless the deploying organization cannot trust its pool of privileged EDI Gateway users.

An attacker who already holds a high-privileged Oracle EDI Gateway account (for example a malicious insider or an adversary who has harvested elevated EBS credentials) sends crafted HTTP requests to the EDI Gateway application. Because attack complexity is low and no user interaction is needed, the requests reliably exploit the flaw to take over the EDI Gateway component, yielding full read, modify, and denial-of-service capability. No public proof-of-concept is referenced in the provided data.