Oracle EDI Gateway EUVD-2026-47059

Exploitation requires the attacker to already hold a low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) and network HTTP access to the EDI Gateway 'Internal Operations' component; the target must be a supported EBS release in the 12.2.3-12.2.15 range with EDI Gateway deployed and reachable. Limiting factors: it is NOT exploitable by a fully unauthenticated attacker (some valid credentials are required), no user interaction is involved, and the scope is unchanged (S:U) with no availability impact - so the concrete risk hinges on whether the EBS/EDI Gateway HTTP endpoints are exposed beyond trusted networks and how many low-privilege accounts exist. There is no availability/DoS avenue; impact is confined to confidentiality and integrity of EDI Gateway-accessible data.

The signals are moderately-to-strongly concerning but not maximal. CVSS 3.1 is 8.1 (High) with AV:N/AC:L/PR:L/UI:N: remotely reachable over HTTP, low attack complexity, no user interaction, requiring only low privileges - a realistic profile for an insider or any account-holder on an exposed EBS instance. Impact is C:H/I:H with A:N, so this is a data-theft and data-tampering risk rather than a denial-of-service or full-host-takeover issue. No EPSS score, KEV entry, or POC was supplied, so there is no evidence of active or imminent exploitation; the risk is currently theoretical-but-credible rather than demonstrated. The PR:L requirement is the main limiter - an unauthenticated attacker cannot exploit this per the vector - so prioritization should weight whether the EBS instance is internet-facing and how tightly low-privilege EDI accounts are controlled. This is a genuine patch-priority item for Oracle EBS operators, especially externally exposed ones, but the absence of exploitation evidence places it below any KEV-listed peer.

An attacker who holds any low-privileged Oracle E-Business Suite account - an insider, a compromised trading-partner login, or an over-provisioned service account - sends crafted HTTP requests to the EDI Gateway Internal Operations component on an internet-facing or network-reachable EBS 12.2 instance. Exploiting the authorization weakness, they read sensitive EDI business documents and then create, alter, or delete critical records outside their intended access scope. No user interaction, malware, or high privileges are needed, though no public POC has been observed at time of analysis.