What is the CVSS score of CVE-2026-60548?

CVE-2026-60548 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle SOA Suite are affected by CVE-2026-60548?

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain an information disclosure vulnerability that allows low-privileged users to access all critical SOA Suite data without authorization,…

How to fix or mitigate CVE-2026-60548?

Within 24 hours, inventory all Oracle SOA Suite instances running versions 12.2.1.4.0 or 14.1.2.0.0 and restrict HTTP network access to these systems to authorized users only, blocking external or unnecessary connections at the firewall level. Within 7 days, implement network segmentation to isolate affected SOA Suite systems from the broader network, conduct a security review of low-privileged account permissions on these systems, deploy enhanced logging and alerting for authentication events and data access patterns, and identify all downstream systems connected to SOA Suite to assess breach scope. Within 30 days, monitor Oracle security advisories for a vendor-released patch and establish a prioritized upgrade timeline based on data sensitivity; for systems handling the most sensitive data, evaluate whether business functions can be temporarily redirected to unaffected systems or versions during remediation.

Oracle SOA Suite CVE-2026-60548

EUVD-2026-46910 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-j3wc-qww8-56p7

Authentication Bypass Information Disclosure Oracle Soa Suite

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP access with a low-privileged account and no user interaction yields authorization bypass causing high confidentiality loss across a scope change, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:43 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.

Technical ContextAI

Oracle SOA Suite is a middleware component of Oracle Fusion Middleware used to build, deploy, and manage service-oriented architecture (SOA) integrations and composite applications, typically deployed on Oracle WebLogic Server. The affected subcomponent, Integration Business Insight (Insight), provides business-activity monitoring and milestone/metric tracking over running integrations, exposed over HTTP. No CWE was assigned in the source data, but the reported behavior - unauthorized read access to critical data combined with a scope change - is consistent with a broken access control / improper authorization weakness (CWE-284/CWE-863 class), aligned with the vendor's 'Authentication Bypass' tag. The scope change (S:C) indicates the vulnerable Insight component can grant access to resources managed by a different security authority, which is why Oracle notes impact to additional products beyond SOA Suite itself.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPU) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not enumerate an exact patched build number, so this is best characterized as a patch available per vendor advisory - consult the CPU matrix for the precise patch/bundle applicable to your 12.2.1.4.0 or 14.1.2.0.0 deployment, as Oracle CPU patches must be verified against the specific installed version. Because the affected component is Integration Business Insight and the vector is HTTP/network, compensating controls until patching include restricting network access to the SOA Suite / Insight HTTP endpoints to trusted management networks (e.g., via WebLogic network channels, reverse-proxy allowlists, or firewall rules), tightening authorization on Insight console/URLs, and monitoring HTTP access logs for anomalous read access to Insight data - noting the trade-off that URL/endpoint restrictions may disrupt legitimate business-monitoring users who rely on Insight dashboards. Do not rely on the 'low privilege' barrier alone since PR:L means any authenticated low-level account may suffice.