What is the CVSS score of CVE-2026-60538?

CVE-2026-60538 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60538?

Oracle SOA Suite deployments (versions 12.2.1.4.0 and 14.1.2.0.0) face critical risk from unauthenticated remote code execution in the Enterprise Scheduling System, enabling attackers to achieve…

How to fix or mitigate CVE-2026-60538?

Within 24 hours, identify all Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 deployments in production environments and isolate HTTP access to these systems; disable or restrict the Enterprise Scheduling System component if operationally feasible. Within 7 days, implement network controls including firewall rules and network segmentation to restrict HTTP access to SOA Suite scheduling endpoints to whitelisted administrative IP ranges only, and deploy WAF rules targeting anomalous scheduling system requests. Within 30 days, prioritize migration to supported Oracle Fusion Middleware versions with available patches, establish 24/7 monitoring and alerting for exploitation attempts against affected systems, and coordinate with Oracle for patch delivery timeline and interim guidance.

Oracle SOA Suite CVE-2026-60538

EUVD-2026-46900 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-3rvh-mmrx-54vf

Authentication Bypass Oracle Soa Suite

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states unauthenticated network HTTP access with no user interaction yielding full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H are justified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:48 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.

Technical ContextAI

Oracle SOA Suite is a middleware platform within Oracle Fusion Middleware used to build, deploy, and manage service-oriented architecture (SOA) composite applications, integrations, and orchestrations. The affected component is the Enterprise Scheduling System (ESS/ESSAPP), which schedules and executes background jobs for Fusion Middleware and Fusion Applications and is typically exposed through WebLogic-hosted HTTP endpoints. Oracle's advisory does not publish a CWE (CWE=N/A in NVD) and provides no technical root-cause detail, but the 'takeover' impact combined with an unauthenticated HTTP vector is consistent with the deserialization, injection, or authentication-bypass classes historically seen in WebLogic/SOA components. The Oracle-supplied tag 'Information Disclosure' understates the stated full C/I/A takeover impact and should be treated with caution.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, referenced at https://www.oracle.com/security-alerts/cpujul2026.html - this is the authoritative source for the exact patch/bundle numbers for SOA Suite 12.2.1.4.0 and 14.1.2.0.0; note that Patch available per vendor advisory (Oracle CPU July 2026), but no exact fix version string is included in the provided data, so confirm the precise patch level from the CPU matrix rather than assuming a version. Because the vulnerable surface is the Enterprise Scheduling System reachable over HTTP, prioritize compensating controls until patching completes: restrict network access to the SOA/ESS WebLogic HTTP and management ports so only trusted management networks can reach them (trade-off: may break legitimate scheduled-job integrations that call ESS remotely), place the endpoints behind a reverse proxy or WAF that blocks unauthenticated access to /ess and SOA composite URLs, and remove any unnecessary internet exposure of the WebLogic managed servers. Avoid undeploying ESSAPP unless you have confirmed no dependent Fusion Middleware jobs rely on it, as that will disable scheduled job execution.