CVE-2026-83345: Oracle XML Gateway Information Disclosure

CVE-2026-83345 Overview

CVE-2026-83345 is a network-exploitable vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite. The flaw resides in the Install component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with HTTP network access can compromise Oracle XML Gateway without user interaction. Successful exploitation exposes all XML Gateway accessible data and can cause a partial denial of service against the component. Oracle disclosed the issue in Oracle Security Alert CSPUSEP2026.

Critical Impact
Authenticated remote attackers can obtain unauthorized access to critical XML Gateway data and degrade service availability over standard HTTP.

Affected Products

Oracle E-Business Suite — Oracle XML Gateway version 12.2.3
Oracle E-Business Suite — Oracle XML Gateway versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle XML Gateway version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83345 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83345

Vulnerability Analysis

CVE-2026-83345 affects the Install component of Oracle XML Gateway, an Oracle E-Business Suite module that handles business-to-business XML message exchange. The vulnerability is reachable over HTTP and requires only low privileges within the application. Oracle classifies the issue as easily exploitable, with no user interaction required.

Successful exploitation grants unauthorized access to all data accessible to Oracle XML Gateway. Because XML Gateway brokers structured business documents such as purchase orders, invoices, and shipping notices, exposed data typically includes sensitive trading partner information. A secondary impact allows attackers to trigger a partial denial of service against the XML Gateway component, degrading availability of dependent EBS workflows.

Root Cause

Oracle has not published detailed root-cause information beyond noting the affected component and required privilege level. The advisory indicates the defect resides in the XML Gateway Install component and is triggered through HTTP requests issued by an authenticated low-privileged account. No CWE mapping has been assigned in the NVD record.

Attack Vector

The attack is executed remotely over the network using HTTP against the Oracle XML Gateway endpoint. The attacker must hold a valid low-privileged EBS account but does not need to interact with any user. The scope is unchanged, and exploitation impacts confidentiality of XML Gateway data with a partial availability impact on the same component. No public proof-of-concept or in-the-wild exploitation has been reported.

Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical guidance.

Detection Methods for CVE-2026-83345

Indicators of Compromise

Unexpected HTTP requests to Oracle XML Gateway servlet paths originating from low-privileged EBS accounts.
Anomalous data extraction volumes from XML Gateway trading partner tables or outbound message queues.
Elevated error rates, thread saturation, or transient outages in the XML Gateway service consistent with partial denial of service.

Detection Strategies

Correlate EBS application audit logs with web-tier HTTP access logs to identify low-privileged sessions invoking XML Gateway Install component endpoints.
Baseline typical XML Gateway request patterns per user and alert on deviations in request volume, response size, or endpoint diversity.
Monitor Oracle HTTP Server and WebLogic access logs for repeated 5xx responses tied to XML Gateway URIs, which may indicate exploitation attempts.

Monitoring Recommendations

Forward EBS mid-tier, database, and web-tier logs to a centralized analytics platform for cross-source correlation.
Enable EBS Sign-On Audit and Page Access Tracking for accounts with XML Gateway responsibilities.
Track privileged and low-privileged access to XML Gateway responsibilities and alert on unexpected role assignments.

How to Mitigate CVE-2026-83345

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
Inventory user accounts assigned XML Gateway responsibilities and revoke access from accounts that do not require it.
Restrict network access to the XML Gateway HTTP endpoints so only trusted trading-partner networks and internal systems can reach them.

Patch Information

Oracle addressed CVE-2026-83345 in Oracle Security Alert CSPUSEP2026. Administrators should download the applicable patch for Oracle E-Business Suite 12.2.x from My Oracle Support and apply it following Oracle's documented EBS patch process, including any required post-install steps for the XML Gateway component.

Workarounds

Place XML Gateway endpoints behind a web application firewall configured to enforce authentication context and rate limiting per session.
Enforce network segmentation so XML Gateway is not reachable from general corporate user networks.
Rotate credentials for any low-privileged EBS accounts suspected of exposure until patching is complete.

bash

# Example: restrict access to the XML Gateway URI at the reverse proxy
# (Apache HTTP Server sample — adapt to your environment)
<Location /oa_servlets/oracle.apps.ecx>
    Require ip 10.10.0.0/16
    Require ip 192.168.50.0/24
</Location>