What is the CVSS score of CVE-2026-60540?

CVE-2026-60540 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60540?

Oracle SOA Suite's Integration Business Insight component contains a critical vulnerability (CVSS 9.6) enabling remote privilege escalation and unauthorized access to all protected data within SOA…

How to fix or mitigate CVE-2026-60540?

Within 24 hours, identify all systems running Oracle SOA Suite and Fusion Middleware, assess their exposure to untrusted networks, and determine whether Integration Business Insight is active and what data sensitivity level it accesses. Within 7 days, implement network-level compensating controls by restricting HTTP access to SOA Suite components to explicitly trusted sources only through firewall rules, enforcing additional authentication mechanisms such as VPN tunneling or multi-factor authentication for all administrative and application access, and enabling enhanced logging on the Integration Business Insight component. Within 30 days, establish daily monitoring of Oracle's security advisory channels for patch availability, prepare a validated deployment and rollback plan for the imminent patch release, and conduct a forensic access audit to identify any unauthorized data access or modifications that may have occurred during the vulnerability window.

Oracle SOA Suite CVE-2026-60540

EUVD-2026-46902 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7q88-c6w3-9rw9

Oracle Authentication Bypass Soa Suite

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Remote HTTP with low-privileged account and no interaction (AV:N/AC:L/PR:L/UI:N); authorization bypass reaching other products gives S:C with high C/I and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:47 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle SOA Suite is an enterprise integration/middleware platform within Oracle Fusion Middleware used to build and run service-oriented and business-process integrations. The flaw resides in the Integration Business Insight component, which provides business-activity monitoring and dashboards over integration flows. The CWE is not assigned by NVD, but the 'Authentication Bypass' tag combined with the CVSS scope-change (S:C) and PR:L profile indicates a low-privileged HTTP-facing function that improperly authorizes access, allowing an authenticated-but-underprivileged user to reach data and operations across trust boundaries. Affected releases are the 12.2.1.4.0 and 14.1.2.0.0 Fusion Middleware trains.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for both affected trains (12.2.1.4.0 and 14.1.2.0.0); the exact patch bundle numbers are enumerated in the CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html - apply the SOA Suite / Fusion Middleware patches for your specific version. No standalone fixed version string is published separately from the CPU, so treat 'apply the July 2026 CPU' as the authoritative remediation. Until patching, restrict network reachability of the Integration Business Insight endpoints by placing the SOA Suite/WebLogic managed servers behind a reverse proxy or WAF that limits access to trusted internal networks, and tighten application-role assignments so low-privileged accounts cannot reach Business Insight functions; note that WAF filtering cannot reliably block an authorization-logic bypass, so network segmentation and least-privilege review are stronger compensating controls than request filtering alone.