EUVD-2026-106091
GHSA-47fg-vh8x-2pw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS credentials
-
DeliveryReach SOA Gateway over HTTP
-
ExploitSatisfy complex exploit preconditions
-
ExecutionAbuse SOA Provider component
-
ImpactTake over Integrated SOA Gateway
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to hold a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Integrated SOA Gateway's SOA Provider component on an affected release (12.2.3 through 12.2.15). The high attack complexity (AC:H) indicates additional conditions outside the attacker's control must be met - Oracle classes this as 'difficult to exploit' - which meaningfully limits reliable, repeatable attacks. No user interaction is needed (UI:N), and scope is unchanged (S:U), so impact is confined to the SOA Gateway itself; the authentication requirement and complexity are the primary limiting factors defenders can rely on. |
| Impact | Signals are mixed and point to a serious-but-not-top-priority issue. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable flaw that nonetheless requires valid low-privileged credentials (PR:L) and has high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their control rather than firing a simple unauthenticated request. The full C:H/I:H/A:H impact with Oracle's own wording of 'takeover' of the SOA Gateway makes technical impact total, which raises priority for any internet-exposed EBS instance. However, no EPSS score, no CISA KEV listing, and no POC were supplied, so exploitation probability is effectively 'no public exploit identified at time of analysis' and there is no evidence of active or automatable exploitation. Net: treat as a high-value patch target for exposed Oracle E-Business Suite deployments (EBS is a frequent attacker objective), but the authentication requirement and high complexity argue against emergency, drop-everything urgency absent new exploitation intelligence. Note a tagging conflict: the input Tags label this 'Information Disclosure,' which understates a vulnerability the description and CVSS rate as full confidentiality, integrity, and availability compromise. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle E-Business Suite account reaches the Integrated SOA Gateway over HTTP and, after meeting the non-trivial conditions implied by the high attack complexity, abuses the SOA Provider component to escalate into full control of the gateway. Because impact is C:H/I:H/A:H, a successful attack yields takeover of the SOA Gateway, exposing and manipulating integrated business data. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Full compromise of the Integrated SOA Gateway - including confidentiality, integrity and availability of the SOA Provider component - is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 by a low-privileged user who already holds a valid EBS account and can reach the gateway over HTTP. Oracle rates the flaw as 'difficult to exploit' (CVSS 3.1 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning conditions outside the attacker's control must align before a successful takeover, and no public exploit code or confirmed active exploitation was identified at time of analysis. The authentication prerequisite and high attack complexity are the main constraints defenders can rely on, so the practical priority is patching on the October 2026 CPU cycle rather than emergency response.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix covering Integrated SOA Gateway 12.2.3 through 12.2.15; Oracle CPUs are cumulative, so install the latest available patch set for your exact EBS release and confirm the SOA Provider component is included in the applied patch list. Where patching must be staged, compensating controls include restricting network access to Integrated SOA Gateway endpoints at the firewall or reverse proxy so only known integration consumers can reach them (trade-off: external or partner integrations break until allow-listed), revoking the Integrated SOA Gateway-related responsibilities and privileges from low-privileged users so the PR:L prerequisite cannot be satisfied (trade-off: legitimate self-service integration users lose access), and disabling SOA Provider services that are not actively consumed (trade-off: hard to reverse quickly if a business flow depends on them). Because exploitation requires only a valid low-privileged account, audit EBS user provisioning and monitor SOAP request logs for anomalous or out-of-role service invocations until the CPU is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Integrated SOA Gateway is the Oracle E-Business Suite integration layer that publishes internal EBS business services and PL/SQL APIs as SOAP/REST endpoints, running on the EBS application tier (Oracle HTTP Server / Oracle Containers for Java or WebLogic). The affected SOA Provider component handles service invocation and metadata publication for those exposed interfaces. No CWE was published for this CVE and Oracle's Critical Patch Update advisory does not disclose the specific coding defect, but the assessed vector (network-reachable, low privilege required, no user interaction, unchanged scope with high impact to all three security properties) is consistent with a missing or insufficient authorization check on a SOA Provider endpoint: a low-privileged authenticated user can invoke operations or reach data beyond their intended privilege level, escalating to administrative control of the gateway. Attack complexity is rated High, reflecting prerequisites such as specific service configuration, timing, or crafted request state that the attacker cannot fully control, which is why Oracle describes it as difficult to exploit. Scope is unchanged, so the impact is bounded to the gateway rather than automatically spreading to unrelated components, although the gateway's trust relationships with back-end EBS services mean takeover should still be treated as a pivot point.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N) but requires a low-privileged account (PR:L) and difficult-to-meet conditions (AC:H); takeover gives full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) exposes the SOA Provider to full confidentiality, integrity, and availability compromise by an authenticated low-privileged user with HTTP reachability, although exploitation requires difficult-to-align conditions and no public exploit identified at time of analysis. Leadership should care because a successful attack could let an internal account take over a core integration service, and no vendor-released patch is currently available; near-term risk must be managed through access restriction and monitoring until the October 2026 CPU.
No vendor-released patch identified at time of analysis; restrict HTTP access to Integrated SOA Gateway/SOA Provider to trusted networks, enforce least privilege and review low-privileged EBS accounts, enable logging and monitoring, and apply the October 2026 CPU when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB