EBS SOA Gateway CVE-2026-101684

Exploitation targets the Oracle E-Business Suite Integrated SOA Gateway (Internal Operations component) and requires the attacker to hold low-level privileges (CVSS PR:L) with network HTTP access to the Gateway endpoint; it affects EBS releases 12.2.3 through 12.2.15. Limiting factors: a valid low-privilege account is required (not fully unauthenticated despite the 'Authentication Bypass' tag), and the Integrated SOA Gateway must be deployed and network-reachable - environments that do not expose or enable the SOA Gateway are not affected. No user interaction is needed, and attack complexity is low, so beyond credential possession and endpoint reachability there are no further special conditions stated by Oracle.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact plus partial availability loss. Oracle's own wording ('Easily exploitable') reinforces the AC:L/PR:L signals. The Integrated SOA Gateway is a well-known, repeatedly-targeted Oracle E-Business Suite attack surface, which raises real-world concern. However, key exploitation signals are MISSING from the provided data: there is no EPSS score, no CISA KEV listing, and no POC indicator in the input, so exploitation likelihood cannot be quantified - treat the 'no public exploit' status as reflecting only the data supplied here, not a vendor-confirmed absence. One tag conflict exists: the input tag 'Authentication Bypass' conflicts with the CVSS vector's PR:L (which requires valid low-level credentials); if an auth bypass were truly present, PR:N would be expected - verify with Oracle whether authentication is actually required. No CWE was supplied and no SSVC decision data was provided, so automatability and the SSVC exploitation-status dimension cannot be assessed.

A low-privileged authenticated user (or an attacker holding a weak/valid EBS account) sends crafted HTTP requests to the Integrated SOA Gateway endpoint, abusing exposed integration/web-service functionality to read, modify, or delete critical EBS data and partially disrupt the service. No user interaction is required and attack complexity is low, so a single reachable account over the network is sufficient. No public exploit was identified in the provided data, but the product's exposure history makes weaponization plausible.