Oracle EDI Gateway CVE-2026-101534

Exploitation requires the attacker to hold a valid low-privilege Oracle E-Business Suite / EDI Gateway account (PR:L) and network HTTP access to the EDI Gateway component on affected EBS 12.2.3-12.2.15 installations; no user interaction is needed (UI:N). The practical limiting factor is that the attacker must already be authenticated with at least a low-level account, so fully anonymous exploitation is not supported by the CVSS data despite the conflicting 'Authentication Bypass' tag. Risk is highest where EDI Gateway is exposed to many internal or partner/self-service users and where the EBS instance is reachable over the network; the scope change means successful attacks can extend beyond EDI Gateway to additional connected Oracle products.

This is a genuine high-priority vulnerability, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw over HTTP with low attack complexity, no user interaction, and only low-level privileges required - meaning any authenticated EBS user can reach it. The scope change (S:C) is the key amplifier: Oracle explicitly states attacks 'may significantly impact additional products,' so compromise is not contained to the EDI Gateway component. Impact is skewed toward confidentiality (C:H - complete access to all EDI Gateway accessible data) with partial integrity loss (I:L) and no availability impact (A:N). Weighing the signals: EPSS is NOT provided, KEV status is NOT listed (no confirmed active exploitation), and no POC is referenced - so despite the 8.5 base score, there is currently no evidence of in-the-wild exploitation or public exploit code. The risk is therefore driven by ease of exploitation and the sensitivity of EBS financial/EDI data rather than by observed attacker activity. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS metric PR:L, which requires the attacker to already hold valid low-level credentials - this is a privilege-requiring flaw, not an authentication bypass; verify the tag against the Oracle advisory. Given Oracle EBS's role as a system of record, this warrants prompt patching in the October 2026 CPU cycle.

A low-privileged user with a valid Oracle E-Business Suite account (for example a limited self-service or partner EDI account) sends a crafted HTTP request to the EDI Gateway component. Because of the scope change, the flaw lets the attacker read all EDI Gateway accessible data and make limited unauthorized modifications, with effects reaching additional connected Oracle products. No public exploit code has been identified at the time of analysis, so this scenario is inferred from the CVSS vector and Oracle's description rather than a demonstrated PoC.