Oracle E-Business Suite SOA Gateway: Improper access control
Summary
The Integrated SOA Gateway of Oracle E-Business Suite versions 12.2.3 to 12.2.15 contains a flaw that allows access control to be bypassed over HTTP. An attacker with a valid low-privileged account and network access to the gateway can create, modify or delete critical data and gain access to data accessible through the gateway, and can cause a partial denial of service. No user interaction is required, and the CVSS base score is 8.3 (high).
Affected
- Oracle E-Business Suite Integrated SOA Gateway 12.2.3 to 12.2.15 (CNA range: up to and including 12.2.15)
Fixed in
- Unknown. Check Oracle's October 2026 Critical Patch Update advisory and My Oracle Support for the EBS 12.2 patch that covers CVE-2026-101684.
Workaround
- No vendor workaround identified.
- Restrict HTTP access to SOA Gateway endpoints to internal networks or VPN only (recommendation, not from Oracle).
- Review accounts that have access to the gateway.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Identify EBS 12.2.x installations in the range 12.2.3 to 12.2.15.
- Check whether the SOA Gateway is reachable from outside your network and restrict access if it is.
- Obtain the patch details from Oracle's advisory and apply them through your regular EBS patch cycle, including the other October 2026 EBS 12.2 fixes.
- Review HTTP logs for unusual SOA Gateway requests and unexpected data changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- CVE record CVE-2026-101684 (vulners CVE list) vulners.com
- Oracle CPU October 2026 (vulners) vulners.com
- Positive Technologies record PT-2026-119360 vulners.com
- Oracle Critical Patch Update October 2026 overview (SecurityOnline) securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:31.
Original description (NVD)
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.