Oracle EDI Gateway CVE-2026-101532

Exploitation requires the attacker to already hold a high-privileged (administrative-level) account on Oracle EDI Gateway within Oracle E-Business Suite (CVSS PR:H), reachable over HTTP on affected versions 12.2.3 through 12.2.15. No user interaction and low attack complexity mean that once that privileged access exists, compromise is straightforward. The limiting factor is precisely the PR:H precondition - without pre-existing high privileges the vulnerability cannot be triggered - so realistic risk is confined to malicious privileged insiders or attackers who have already obtained administrative credentials.

This is a genuine but access-gated vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) confirms network reachability over HTTP with low attack complexity and no user interaction, and full confidentiality, integrity and availability impact culminating in 'takeover' of Oracle EDI Gateway. The decisive mitigating signal is PR:H: the attacker must already hold high-privileged (administrative-level) access, which sharply narrows the realistic threat population to insiders or adversaries who have already compromised privileged credentials. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC-style reading: exploitation=none observed, technical impact=total, automatable=likely no (privileged precondition). Net: patch on a normal-to-prioritized Oracle CPU cadence, but this is not a drop-everything internet-worm scenario given the PR:H barrier. Note one metadata inconsistency: the input tag labels this 'Information Disclosure,' yet the description and vector describe full takeover with I:H/A:H - treat the tag as under-stating impact.

An attacker who already possesses high-privileged credentials on an Oracle E-Business Suite environment (or who has harvested such credentials via prior compromise) sends crafted HTTP requests to the Oracle EDI Gateway component. Because attack complexity is low and no user interaction is needed, the request reliably drives the flaw to full compromise, resulting in takeover of the EDI Gateway with confidentiality, integrity and availability impact. No public exploit code is identified at time of analysis, so exploitation would require the actor to develop their own method.