CVE-2026-101466

Awaiting Analysis Awaiting Analysis - Queue

Oracle EDI Gateway Remote Code Execution Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Oracle

Description

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101466

EUVD

EUVD-2026-105882

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle EDI Gateway	12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle EDI Gateway within Oracle E-Business Suite. It allows a highly privileged attacker with network access via HTTP to take over the system. The vulnerability has a CVSS base score of 7.2, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

Detection of CVE-2026-101466 requires checking for vulnerable versions of Oracle EDI Gateway (12.2.3-12.2.15) and verifying if the HTTP network access vector is exposed to high-privileged attackers. Review Oracle E-Business Suite logs for unauthorized access attempts or unusual activity in the EDI Gateway component.

Impact Analysis

An attacker could exploit this to gain full control of the Oracle EDI Gateway, potentially leading to data breaches, unauthorized modifications, or system downtime. High-privileged users are required for exploitation, but the impact is severe.

Compliance Impact

This vulnerability allows high privileged attackers to compromise Oracle EDI Gateway, potentially leading to unauthorized access, data breaches, or system takeover. Such breaches could expose sensitive data, violating GDPR (data protection) and HIPAA (healthcare data privacy) compliance requirements.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in EDI Gateway. Ensure network access controls restrict HTTP access to only trusted sources. Monitor for unusual activity in Oracle EDI Gateway logs.

Hi! I’m here to help you understand CVE-2026-101466. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...