Oracle SOA Suite EUVD-2026-106479

Exploitation targets the Fabric Layer component of Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0, reachable over the network via HTTP. The vector's PR:L means the attacker must hold a low-privileged authenticated account on the system - exploitation is not fully anonymous. No user interaction is required (UI:N) and attack complexity is low (AC:L). The limiting factors for defenders are therefore the authentication requirement (any valid low-privilege credential) and exposure of the SOA Suite HTTP interface; the scope change (S:C) means a successful compromise can extend impact to additional connected products, so network segmentation of the SOA Suite instance materially reduces blast radius.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes remote, low-complexity exploitation requiring only low privileges, no user interaction, and a scope change that yields full confidentiality, integrity, and availability compromise ('takeover'). The scope change (S:C) is the key aggravator - successful attacks can significantly impact products beyond SOA Suite itself. Countervailing signals that normally raise or lower urgency are simply absent here: no EPSS exploitation-probability score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied either. The net picture is a critical-severity, vendor-confirmed flaw with low attack barriers but, as of this analysis, no evidence of active exploitation or public exploit code - meaning patch urgency is driven by severity and exploitability, not by observed in-the-wild activity. Note the one dependency: PR:L means the attacker must already hold some low-level authenticated access, which modestly constrains purely anonymous internet-wide exploitation.

A low-privileged user with network access sends crafted HTTP requests to the Fabric Layer component of an exposed Oracle SOA Suite instance and leverages the flaw to fully compromise the service. Because of the scope change, the attacker can pivot beyond SOA Suite to impact additional connected Fusion Middleware products. No public exploit code is identified at time of analysis, so exploitation would currently require independent development.