EUVD-2026-106089
GHSA-m8g4-mxvv-q4ww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliverySend crafted HTTP request to SOA Provider
-
ExploitExploit SOA Gateway flaw
-
ExecutionAchieve component takeover
-
ImpactCompromise confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle E-Business Suite Integrated SOA Gateway over HTTP and a valid low-privileged account on the EBS instance (PR:L) - it is not anonymous/unauthenticated. The specific attack surface is the Integrated SOA Gateway's SOA Provider component, so the condition is that the Integrated SOA Gateway is deployed and its SOA Provider endpoints are HTTP-reachable by the attacker; EBS installations that do not enable or expose the Integrated SOA Gateway reduce exposure. No user interaction and no special non-default configuration beyond having the SOA Gateway in use are required (AC:L/UI:N). The authentication requirement and gateway-exposure dependency are the primary limiting factors against purely external, unauthenticated attackers. |
| Impact | This is a credible, high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable flaw over HTTP, with low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability resulting in 'takeover' of the Integrated SOA Gateway. The only gating factor is PR:L - the attacker must hold low-level privileges (an authenticated but minimally-privileged account), which is often trivially obtainable in large EBS deployments with many users. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability and in-the-wild activity cannot be quantified; this should be treated as absence of signal, not evidence of low risk. One inconsistency to verify: the input Tags label this 'Information Disclosure,' yet Oracle's own description and the C:H/I:H/A:H vector indicate full system takeover, not mere disclosure - defenders should scope this as a takeover-class issue, not a read-only leak. Given Oracle's description of 'easily exploitable' and the Oracle CPU pedigree, this warrants prompt patching rather than deferral. |
| Exploit ScenarioDerived | An attacker possessing a low-privileged account on an Oracle E-Business Suite instance sends crafted HTTP requests to the Integrated SOA Gateway's SOA Provider endpoint. Exploiting the flaw with low complexity and no user interaction, the attacker escalates to full control of the SOA Gateway, gaining the ability to read, modify, and disrupt its data and services. No public exploit code was identified in the provided data, but Oracle characterizes the vulnerability as 'easily exploitable.' |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 contain a high-severity flaw in the SOA Provider component that allows a low-privileged, authenticated attacker with HTTP network access to take over the affected gateway. Successful exploitation can fully compromise confidentiality, integrity, and availability of the Integrated SOA Gateway (CVSS 8.8). No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is limited to EBS deployments that enable and expose the Integrated SOA Gateway.
RemediationAI
Apply the Oracle E-Business Suite Integrated SOA Gateway fixes published in the Oracle Critical Patch Update October 2026 advisory (https://www.oracle.com/security-alerts/cpuoct2026.html); the input does not identify an exact patched build, so confirm the fixed version in the vendor advisory before deployment. Until patching is complete, reduce exposure by restricting HTTP access to Integrated SOA Gateway SOA Provider endpoints to trusted networks or integration hosts, with the trade-off that legitimate SOA integrations may be interrupted. If the gateway is not required, disable it; this removes the attack surface but breaks any dependent SOA integrations. Enforce least privilege and review low-privileged EBS accounts that can reach the gateway, recognizing that this limits but does not eliminate exploitation because the vulnerability requires only a valid low-privileged account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite Integrated SOA Gateway exposes EBS business logic as SOAP/REST services and includes a SOA Provider component that handles service invocation over HTTP. The vulnerability is in that SOA Provider attack surface and is reachable over the network with low attack complexity and no user interaction (AV:N/AC:L/UI:N), but it requires a valid low-privileged EBS account (PR:L) and an exposed Integrated SOA Gateway deployment. The input does not provide a CWE classification, so the precise root-cause class is not disclosed; the CVSS vector indicates high confidentiality, integrity, and availability impact with scope unchanged, consistent with compromise of the SOA Provider component itself rather than the entire underlying host or database. Installations that do not enable or externally expose the Integrated SOA Gateway have reduced exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector with low complexity and no user interaction; PR:L because Oracle states a low-privileged (authenticated) attacker, and takeover yields full C/I/A impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 carry a high-severity flaw that can let an attacker with HTTP access take over the gateway, fully compromising the confidentiality, integrity, and availability of that integration component. Leadership should care because exposed SOA Gateway deployments can become a path to disruption of EBS-connected business processes and data exposure; no public exploit has been identified at time of analysis, and no vendor patch is available yet.
No vendor-released patch identified at time of analysis; restrict network access to Integrated SOA Gateway/SOA Provider endpoints, disable the component where not required, enforce least privilege for accounts with access, deploy WAF/IPS virtual patching, and monitor for anomalous HTTP activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB