EUVD-2026-61301
GHSA-h58c-q3m7-76gw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network vector confirmed; PR:L reflects required low-privilege credential; full CIA impact consistent with described takeover; no scope change evident.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine component via HTTP, with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, covering both the long-term supported and newer release trains of this enterprise middleware. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess low-privilege credentials for Oracle SOA Suite - no unauthenticated exploitation path is indicated by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 is well-supported by the vector metrics: network-accessible, low complexity, low privilege, no user interaction, and full C/H/I/A impact - a strong signal for a highly exploitable and impactful flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Patch Update for August 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all deployed SOA Suite instances running versions 12.2.1.4.0 or 14.1.2.0.0; immediately restrict network access to the B2B Engine component to authorized internal networks only, requiring VPN or jump-host access for any remote connections; enable detailed logging of all HTTP traffic to B2B Engine endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System com
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attack
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated high sev
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Eng
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attack
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0,
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Rated high severity (CV
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resulta
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today