Oracle EDI Gateway CVE-2026-101533

Exploitation requires the attacker to already hold HIGH privileges (PR:H) within the Oracle E-Business Suite environment and to reach the EDI Gateway over the network via HTTP (AV:N). The specific trigger is in the 'All Miscellaneous EDI Issues' handling of the Oracle EDI Gateway component on affected EBS 12.2.3-12.2.15 installations. Key LIMITING factors: the flaw is explicitly 'difficult to exploit' (AC:H), meaning success depends on specific conditions or timing outside the attacker's direct control, and the high pre-existing privilege requirement means this is not reachable by anonymous or low-privileged users. No user interaction is required (UI:N). The exploit does not cross a trust boundary to other components (S:U, scope unchanged).

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 base score of 6.6 (MEDIUM) is driven down by two limiting metrics in Oracle's own vector: AC:H (high attack complexity - 'difficult to exploit' per the description) and PR:H (the attacker must already hold high privileges on the target). Those offset the otherwise serious AV:N (network/HTTP) reach and the full C:H/I:H/A:H 'takeover' impact. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the intelligence set, which is itself a signal: there is no evidence of active exploitation or weaponization. The practical read is that an attacker already needs privileged access to Oracle EDI Gateway before this flaw adds value, so it functions more as a privilege-to-takeover escalation / post-compromise lever than an external breach vector. Note one consistency point to verify: the Tags label this 'Information Disclosure,' but the description and CVSS vector describe full confidentiality, integrity, AND availability compromise ('takeover') - the tag understates the real impact and should not be used to deprioritize patching.

An attacker who has already obtained a high-privilege account on an Oracle E-Business Suite environment sends crafted HTTP requests to the Oracle EDI Gateway component, exploiting the flaw in miscellaneous EDI handling to escalate to full control of the EDI Gateway. Because attack complexity is high, the attacker must win specific timing or configuration conditions rather than firing a one-shot exploit. No public exploit identified at time of analysis.