CVE-2026-61315
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Oracle EDI Gateway (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, there is an easily exploitable vulnerability. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
Risk Assessment
The organization may be at risk of data leakage from Oracle EDI Gateway, potentially exposing confidential business information.
Recommendation
Apply patches provided by Oracle in the Critical Patch Update program. Restrict network access to the system.
Other vulnerabilities in Oracle EDI Gateway
See all- CVE-2026-61316Medium
In Oracle EDI Gateway (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, there is an easily exploitable vulnerability. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
- CVE-2026-61314High
Vulnerability in Oracle EDI Gateway (Oracle E-Business Suite) allows a high-privileged attacker with network access via HTTP to take over the system. Affects versions 12.2.3-12.2.15.
- CVE-2026-61303Low
Vulnerability in Oracle EDI Gateway (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, requires high-privileged attacker with local logon, allows unauthorized read access to a subset of data.
- CVE-2026-60756High
Vulnerability in Oracle EDI Gateway (component: All Miscellaneous EDI Issues) versions 12.2.3-12.2.15. Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-60710High
Vulnerability in Oracle EDI Gateway (Internal Operations component) in Oracle E-Business Suite versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.
Original NVD description (English source)
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).