What is the CVSS score of CVE-2026-60546?

CVE-2026-60546 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60546?

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability in the Integration Business Insight component allowing complete system compromise by authenticated attackers with…

How to fix or mitigate CVE-2026-60546?

Within 24 hours, inventory all Oracle SOA Suite systems running versions 12.2.1.4.0 or 14.1.2.0.0, assess their network exposure, and restrict HTTP access to affected instances if immediate patching is not possible. Within 7 days, apply the vendor-released patch from Oracle's Critical Patch Update issued July 2026 to all affected systems. Within 30 days, verify patch deployment across the entire SOA Suite estate and conduct a privileged access audit to validate that only necessary high-privilege accounts remain active.

Oracle SOA Suite CVE-2026-60546

EUVD-2026-46908 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-jj74-jcpq-xrq4

Privilege Escalation Oracle Soa Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP access with low complexity but requiring high SOA Suite privileges (PR:H), yielding full confidentiality, integrity, and availability compromise within an unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:56 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.

Technical ContextAI

Oracle SOA (Service-Oriented Architecture) Suite is enterprise middleware within Oracle Fusion Middleware used to build, deploy, and manage composite integration services, typically running atop Oracle WebLogic Server and accessed over HTTP(S). The affected component, Integration Business Insight (BI), provides business-activity monitoring and dashboarding over SOA process data. Oracle does not disclose the specific weakness class (CWE is N/A in the input), and Oracle CPU advisories characteristically omit root-cause detail; the CVSS vector (S:U, C:H/I:H/A:H) indicates the flaw lets an already-privileged user escalate to full control of the SOA Suite process itself rather than crossing into a separate security scope. The 'Information Disclosure' tag combined with full I/A impact suggests the vulnerable code path exposes or manipulates data and functionality the authenticated principal should not fully control.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle CPUs ship as cumulative patch bundles rather than a single re-versioned release, so no distinct fixed build number is provided in the input and admins should pull the SOA Suite patch corresponding to their base version (12.2.1.4.0 or 14.1.2.0.0). Because exploitation requires high privileges, the strongest compensating control until patching is tightening administrative access to the SOA Suite and the Integration Business Insight console: restrict and audit high-privilege accounts, enforce strong/MFA-backed authentication on WebLogic admin and BI roles, and network-restrict the HTTP management and BI endpoints to trusted operator subnets (trade-off: may disrupt remote administration and monitoring workflows). Avoid exposing SOA Suite management interfaces directly to untrusted networks, and monitor for anomalous privileged activity against the BI component. Do not rely on workarounds long-term, as they do not remove the underlying flaw.