Oracle E-Business Suite EUVD-2026-106093

Exploitation requires the Oracle E-Business Suite Integrated SOA Gateway (SOA Provider component) to be deployed and enabled on an affected release (12.2.3 through 12.2.15), with HTTP network reachability to the gateway endpoint. Per the CVSS vector (PR:L), the attacker needs a low-privileged authenticated account rather than fully unauthenticated access, which is the primary limiting factor; attack complexity is low and no user interaction is required. Internet-facing SOA Gateway deployments materially increase real-world exposure, while environments where the SOA Gateway module is not activated are not affected.

This is a credible mid-to-high priority issue, but not a drop-everything emergency based on the data provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change amplifying impact to additional products - a confidentiality-only compromise (C:H, I:N, A:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (network vector matches the HTTP-based description; PR:L matches the 'low privileged attacker' language), so there is no CVSS-versus-description conflict to flag. Important context: Oracle E-Business Suite Integrated SOA Gateway has historically been a high-value, actively targeted attack surface, so despite the absence of KEV/EPSS/POC signals here, defenders with internet-exposed SOA Gateway should treat Oracle CPU patching as a near-term priority rather than deferring. The 'Authentication Bypass' tag conflicts with the PR:L requirement (which indicates an authenticated low-privilege account is needed) and should be treated with caution.

A low-privileged attacker with a valid EBS account (or access to a weakly protected service account) sends a crafted HTTP request to the internet-facing Integrated SOA Gateway SOA Provider endpoint. Due to a flaw that crosses a trust boundary (scope change), the request yields unauthorized read access to critical data across the EBS environment and connected products. No public exploit code was identified at time of analysis, and exploitation requires network reachability to the SOA Gateway plus low-level authentication.