EUVD-2026-46906
GHSA-ww3j-m9w6-m776
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SOA Suite B2B HTTP endpoint
-
DeliverySend crafted B2B request
-
ExploitBypass access controls in B2B Engine
-
ExecutionRead critical SOA Suite data
-
ImpactExfiltrate data and cause partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an Oracle SOA Suite instance running the B2B Engine component at version 12.2.1.4.0 or 14.1.2.0.0; per AV:N/AC:L/PR:N/UI:N there is no authentication, no special client privilege, and no user interaction needed against a reachable B2B Engine endpoint. The primary limiting factor is exposure of that HTTP interface - installations where the B2B component is disabled/unused or where the listener is confined to a trusted internal/partner network are not remotely reachable by arbitrary attackers, sharply reducing practical risk. Version is also a hard gate: only the two named releases are confirmed affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) signals a genuinely low-barrier issue: reachable over the network, low complexity, no privileges, and no user interaction, with high confidentiality impact and only partial availability impact. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure cannot be quantified - priority rests on the intrinsic vector rather than observed activity. The vendor-supplied 'Authentication Bypass' tag is consistent with PR:N (no authentication needed to reach the vulnerable function). One inconsistency to verify: the tags emphasize 'Denial Of Service', but CVSS scores availability only Low and integrity None, so the dominant real risk is data confidentiality, not full DoS. Given SOA Suite's typical role handling sensitive B2B/integration data, treat this as a real priority for internet- or partner-facing deployments. |
| Exploit ScenarioDerived | An attacker who can reach the SOA Suite B2B Engine HTTP interface sends a crafted request that abuses the vulnerable B2B message-handling logic to read data it should not be able to access, exfiltrating sensitive integration or business documents without any login. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), a single reachable unpatched endpoint suffices; the same interaction can also degrade the service, causing a partial denial of service. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fixed build number is stated in the provided data, so identify the exact patch for your installed release (12.2.1.4.0 or 14.1.2.0.0) from the CPU matrix and apply it during an emergency or scheduled maintenance window. Until patched, reduce exposure by restricting network reachability of the SOA Suite B2B Engine HTTP endpoints to trusted partner networks via firewall or reverse-proxy allowlisting, and place the B2B listener behind a WAF or VPN rather than exposing it directly to the internet - the trade-off is that legitimate external B2B partners may require explicit allowlist entries, which can disrupt document exchange if misconfigured. If the B2B Engine is not in use, consider disabling or removing that component to eliminate the attack surface, accepting the loss of B2B integration functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle SOA Suite is an enterprise service-oriented-architecture middleware layer within Oracle Fusion Middleware, used to build, deploy, and orchestrate composite applications and integration flows. The affected component is the B2B Engine, which handles business-to-business document exchange (e.g., EDI, AS2, ebXML) and here is exposed via HTTP. The description indicates unauthorized read access to critical data plus a partial availability impact, consistent with an information-disclosure / broken-access-control class of flaw in the B2B message-processing path; the vendor did not assign a CWE (CWE: N/A), so the precise root cause (e.g., improper access control, XXE/SSRF-style parsing, or path traversal) cannot be confirmed from the provided data.
Know when Soa Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Unauthenticated HTTP access to the B2B Engine gives AV:N/AC:L/PR:N/UI:N; description supports high confidentiality loss (C:H), no integrity impact (I:N), and only partial DoS (A:L).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
Executive ViewAI
Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated remote vulnerability in the B2B Engine component that allows attackers to read all data accessible to the product without credentials, creating immediate risk of unauthorized access to operational and customer information. No vendor patch is currently available, forcing organizations to implement interim containment while awaiting a fix. This network-accessible vulnerability ranks among Oracle's highest-severity July 2026 issues due to its low attack complexity and broad data exposure scope.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to B2B Engine to authorized internal systems only; implement Web Application Firewall rules to block external B2B Engine requests; disable B2B Engine if not operationally required; implement comprehensive audit logging of all B2B Engine data access; isolate affected Oracle SOA Suite systems on dedicated network infrastructure; perform immediate review of access logs to detect potential unauthorized data retrieval.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System com
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attack
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine c
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated high sev
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attack
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0,
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Rated high severity (CV
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resulta
Exploit-DB