What is the CVSS score of CVE-2026-60544?

CVE-2026-60544 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60544?

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated remote vulnerability in the B2B Engine component that allows attackers to read all data accessible to the product…

How to fix or mitigate CVE-2026-60544?

Within 24 hours, inventory all Oracle SOA Suite instances in your environment identifying those running versions 12.2.1.4.0 or 14.1.2.0.0, and immediately implement network-level access restrictions to the B2B Engine component, permitting traffic only from known authorized internal systems. Within seven days, deploy network segmentation isolating affected SOA Suite systems from untrusted network zones, and establish real-time monitoring and alerting for any B2B Engine access attempts originating from external sources. Within 30 days, apply the vendor-released patch for Oracle SOA Suite as soon as Oracle releases it, perform comprehensive testing in a staging environment, and conduct a data access audit to determine whether unauthorized access occurred during the vulnerability window.

Oracle SOA Suite CVE-2026-60544

EUVD-2026-46906 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-ww3j-m9w6-m776

Oracle Denial Of Service Authentication Bypass Soa Suite

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated HTTP access to the B2B Engine gives AV:N/AC:L/PR:N/UI:N; description supports high confidentiality loss (C:H), no integrity impact (I:N), and only partial DoS (A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:45 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.

Technical ContextAI

Oracle SOA Suite is an enterprise service-oriented-architecture middleware layer within Oracle Fusion Middleware, used to build, deploy, and orchestrate composite applications and integration flows. The affected component is the B2B Engine, which handles business-to-business document exchange (e.g., EDI, AS2, ebXML) and here is exposed via HTTP. The description indicates unauthorized read access to critical data plus a partial availability impact, consistent with an information-disclosure / broken-access-control class of flaw in the B2B message-processing path; the vendor did not assign a CWE (CWE: N/A), so the precise root cause (e.g., improper access control, XXE/SSRF-style parsing, or path traversal) cannot be confirmed from the provided data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fixed build number is stated in the provided data, so identify the exact patch for your installed release (12.2.1.4.0 or 14.1.2.0.0) from the CPU matrix and apply it during an emergency or scheduled maintenance window. Until patched, reduce exposure by restricting network reachability of the SOA Suite B2B Engine HTTP endpoints to trusted partner networks via firewall or reverse-proxy allowlisting, and place the B2B listener behind a WAF or VPN rather than exposing it directly to the internet - the trade-off is that legitimate external B2B partners may require explicit allowlist entries, which can disrupt document exchange if misconfigured. If the B2B Engine is not in use, consider disabling or removing that component to eliminate the attack surface, accepting the loss of B2B integration functionality.