What is the CVSS score of CVE-2026-60543?

CVE-2026-60543 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60543?

Oracle SOA Suite instances running Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 can be fully compromised by remote attackers without authentication through a B2B Engine vulnerability.

How to fix or mitigate CVE-2026-60543?

Within 24 hours, complete an inventory of all Oracle SOA Suite instances across production, pre-production, and development environments, documenting which run vulnerable versions 12.2.1.4.0 or 14.1.2.0.0 and their criticality to business operations. Within 7 days, implement network segmentation to restrict B2B Engine access to authorized internal systems only, deploy Web Application Firewall rules to block anomalous HTTP traffic targeting the vulnerability, enable comprehensive logging and alerting on all B2B Engine activity, and apply least-privilege access controls to affected instances. Within 30 days, establish direct engagement with Oracle support to obtain patch timelines, evaluate upgrade paths to non-vulnerable Fusion Middleware versions, and develop a phased migration plan prioritizing business-critical SOA deployments.

Oracle SOA Suite CVE-2026-60543

EUVD-2026-46905 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-hcp7-wqhq-5jrv

Oracle Authentication Bypass Soa Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable B2B HTTP with no auth or interaction (AV:N/PR:N/UI:N), vendor-confirmed difficult exploitation (AC:H), and full takeover giving C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:45 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Oracle SOA Suite is an enterprise integration and orchestration platform within Oracle Fusion Middleware, used to build and run SOA composites, BPEL processes, and business-to-business (B2B) document exchange. The vulnerable code lives in the B2B Engine, the subsystem that processes inbound and outbound trading-partner messages over transports such as HTTP, which is the attack surface here (AV:N via HTTP). Oracle assigns no CWE (CWE: N/A) and discloses no root-cause class; a network-reachable 'takeover' in a Java message-processing engine is consistent with deserialization, injection, or XML/message-parsing weaknesses typical of this middleware, but the specific weakness class is not stated in the available data and should not be presented as confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update (CPU) of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0; Oracle ships these fixes only within the quarterly CPU rather than as a standalone version, so patch to the CPU-corresponding SOA Suite patch level for your release. Patch available per vendor advisory. Until the CPU is applied, reduce exposure of the B2B Engine by restricting network reachability of its HTTP endpoints to known trading partners using firewall/reverse-proxy allowlists and mutual TLS, and by removing the B2B transport listener from any internet-facing path (trade-off: this can disrupt legitimate partner document exchange and must be coordinated with B2B partners). Front the deployment with a WAF and monitor B2B Engine and HTTP access logs for anomalous inbound messages as detective controls; these are compensating measures only and do not fix the underlying flaw.