This vulnerability affects Oracle EDI Gateway within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in complete takeover of the Oracle EDI Gateway. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has published this issue as part of its July 2026 Critical Patch Update, which includes patches for many vulnerabilities. However, the vendor advisory does not explicitly confirm the availability of a specific patch for this vulnerability in the provided content, so patch status should be verified in the official advisory.

Successful exploitation can lead to full compromise of Oracle EDI Gateway, impacting confidentiality, integrity, and availability of the system. An attacker can take over the gateway without authentication, which poses a significant risk to the affected environment.

Oracle has released a Critical Patch Update in July 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches from this update promptly. Since the vendor advisory does not explicitly confirm the patch status for this specific vulnerability in the provided content, users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. No alternative mitigations or workarounds are provided in the advisory.