What is the CVSS score of CVE-2026-60541?

CVE-2026-60541 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60541?

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 expose the Enterprise Scheduling System to unauthenticated remote complete takeover, creating immediate risk of total infrastructure compromise for…

How to fix or mitigate CVE-2026-60541?

Within 24 hours, conduct a complete inventory of Oracle SOA Suite deployments identifying all systems running versions 12.2.1.4.0 or 14.1.2.0.0 and assess their operational criticality and network exposure. Within 7 days, implement network segmentation restricting HTTP access to the Enterprise Scheduling System component to authorized internal sources only, and disable the ESS service if not operationally essential. Within 30 days, establish continuous monitoring of Oracle security advisories for patch releases and develop emergency patching procedures to deploy fixes within 24 hours of availability.

Oracle SOA Suite CVE-2026-60541

EUVD-2026-46903 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xpm7-m2r7-wpxv

Oracle Authentication Bypass Soa Suite

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description confirms unauthenticated HTTP-reachable takeover with no user interaction, so AV:N/AC:L/PR:N/UI:N, and full product compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:46 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.

Technical ContextAI

Oracle SOA Suite is a middleware platform within Oracle Fusion Middleware used to build, deploy, and manage service-oriented and integration workflows (BPEL, mediator, business rules). The affected element is the Enterprise Scheduling System (ESS/Oracle Enterprise Scheduler), the component responsible for defining and running scheduled batch jobs across Fusion Middleware and Fusion Applications, typically reachable over HTTP through the WebLogic-hosted application tier. Oracle's advisory does not assign a CWE (CWE: N/A) and provides no technical root-cause detail; based on the 'takeover' outcome and unauthenticated network vector, the flaw is most consistent with a pre-authentication injection or deserialization/remote-code-execution class defect exposed by the ESS HTTP endpoints, though the exact weakness is not published.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes CPU patches per product version and stack, so administrators should map their exact 12.2.1.4.0 or 14.1.2.0.0 deployment to the corresponding CPU patch (no single fixed version string is provided in the input, so cite the CPU rather than an invented version). Until patching completes, restrict network access to the Enterprise Scheduling System / SOA HTTP endpoints so they are reachable only from trusted management networks (via firewall rules, WebLogic connection filters, or a reverse-proxy allowlist), and remove any direct internet exposure of the SOA/ESS application tier; the trade-off is that legitimate remote integration clients and scheduled-job consumers must be explicitly allowlisted, which can break automated jobs if their source addresses are not accounted for. Monitor the SOA/WebLogic access logs for anomalous requests to ESS URLs as a compensating detection control.