Oracle EDI Gateway CVE-2026-101519

Exploitation requires the attacker to already possess HIGH application-level privileges on Oracle EDI Gateway (PR:H) and network reachability to its HTTP interface; it affects Oracle E-Business Suite EDI Gateway versions 12.2.3 through 12.2.15. The dominant limiting factor is this pre-existing privileged access - this is not remotely exploitable by an anonymous/unauthenticated attacker - which confines realistic abuse to privileged insiders or adversaries who have already compromised a privileged EBS account. No special non-default configuration is called out in the description beyond having the EDI Gateway component deployed and network-accessible over HTTP; no end-user interaction is required.

This is a genuinely serious-but-gated issue rather than a drop-everything emergency. The CVSS 3.1 base score of 7.2 (High) derives from a network attack vector (AV:N) over HTTP with low complexity (AC:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H) resulting in complete takeover of Oracle EDI Gateway. The decisive mitigating signal is PR:H - exploitation requires an attacker who already holds HIGH privileges on the system, which sharply narrows the realistic threat population to insiders or attackers who have already compromised a privileged account. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this is MISSING data. The CVE is not listed in CISA KEV and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (network vector matches the HTTP-based description), so there is no CVSS-vs-description conflict to flag - but the high-privilege prerequisite means this should be prioritized below unauthenticated network-facing flaws of the same score. Treat as a standard-priority patch within the normal Oracle Critical Patch Update cycle unless the EDI Gateway is internet-exposed with weak privilege segregation.

An attacker who has already obtained a high-privileged Oracle EDI Gateway/E-Business Suite account (e.g., a malicious insider or an adversary who harvested privileged credentials) sends crafted HTTP requests to the EDI Gateway component. Because attack complexity is low and no user interaction is needed, the requests reliably abuse the flaw to fully compromise the component, yielding complete control over EDI Gateway data and processing. No public exploit code is known at time of analysis, so this would currently require custom exploit development.