Oracle SOA Suite CVE-2026-60540

Exploitation requires network HTTP access to an Oracle SOA Suite deployment running the Integration Business Insight component, plus a low-privileged authenticated account on the target (CVSS PR:L, not PR:N), but no user interaction and low attack complexity. Limiting factors: the attacker must reach the Business Insight HTTP interface (internal-network segmentation or lack of internet exposure meaningfully reduces exposure) and must possess at least low-level credentials rather than being fully unauthenticated. It applies specifically to Fusion Middleware SOA Suite 12.2.1.4.0 and 14.1.2.0.0; other versions are not listed as affected.

This is a genuine high priority, not an inflated high-CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes easy remote HTTP exploitation needing only low privileges and no user interaction, with high confidentiality and integrity impact and a scope change reaching other products - Oracle itself calls it 'easily exploitable.' No EPSS score, KEV entry, or POC was provided, so exploitation-probability signals are absent: this appears to be a coordinated vendor disclosure (reported by secalert_us@oracle.com) rather than observed in-the-wild activity. The main uncertainty is that CWE is unassigned and no SSVC decision data is supplied, so root-cause detail is inferred from the 'Authentication Bypass' tag rather than confirmed. Availability impact is None (A:N), so this is a data-exposure/tampering risk rather than a denial-of-service risk.

An attacker who holds any low-privileged SOA Suite account (or obtains one) sends crafted HTTP requests to the Integration Business Insight component and, due to the authorization bypass, gains read/write access to data and operations they should not reach. Because of the scope change, the attacker can pivot to affect data in additional connected products beyond SOA Suite. No public exploit code has been identified, and exploitation requires no user interaction.