CVE-2026-83345

Oracle E-Business Suite's XML Gateway product (Install component) contains an easily exploitable flaw affecting releases 12.2.3 through 12.2.15. A low-privileged attacker — i.e., one holding a valid, low-level account — with network access via HTTP can trigger the flaw to compromise Oracle XML Gateway, resulting in unauthorized access to critical data or complete access to all Oracle XML Gateway accessible data, plus the ability to cause a partial denial of service. The issue carries a CVSS 3.1 base score of 7.1 (high), with high confidentiality and low availability impact and no integrity impact. Organizations running affected E-Business Suite 12.2 releases with XML Gateway exposed over the network are at risk, particularly if the HTTP endpoints are reachable by broad user populations. There is no known public proof-of-concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83345 to all Oracle E-Business Suite 12.2.3–12.2.15 environments running XML Gateway. Restrict HTTP access to XML Gateway endpoints (e.g., via network segmentation, allow-listing, or Web Entry Point/WAF rules) so only trusted internal users and integration partners can reach them. Review XML Gateway logs for anomalous data access or unexpected traffic patterns from low-privilege accounts, and verify that EBS Self Service / gateway URLs are not unnecessarily internet-exposed.