EUVD-2026-106485
GHSA-6w75-2p53-mvv6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SOA Suite HTTP endpoint
-
DeliverySend crafted request to Fabric Layer
-
ExploitExploit unauthenticated flaw
-
ExecutionRead critical SOA-accessible data
-
ImpactImpact adjacent products via scope change
Vulnerability Assessment
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation via HTTP against the Fabric Layer component of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, with no authentication or user interaction required (PR:N/UI:N). The principal limiting factor is network exposure: the SOA Suite HTTP interface must be reachable by the attacker, and in many deployments it sits on internal/management networks rather than the public internet, which constrains the realistic attacker population. The scope change (S:C) means successful exploitation can affect additional products beyond SOA Suite, so the blast radius depends on what Fusion Middleware components are co-deployed. |
| Impact | All exploitability signals point to a genuinely high-priority flaw: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, with a scope change that lets impact spill beyond SOA Suite into adjacent products. Confidentiality impact is High (complete read of SOA-accessible data) with a Low integrity impact (partial update/insert/delete) and no availability impact. However, several real-world-risk signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no POC indicator, so exploitation status must be read as 'no public exploit identified at time of analysis' - this is a credential-free, high-CVSS issue but there is no evidence yet of active or widespread exploitation. The 'Authentication Bypass' tag is directionally consistent with PR:N but the description characterizes this as unauthenticated access rather than explicitly a bypass of an auth mechanism - treat the tag as a hint, not confirmation. Net: patch-worthy and high priority due to unauthenticated network reach plus scope change, but prioritization above actively-exploited CPU entries is not justified absent EPSS/KEV data. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the Oracle SOA Suite Fabric Layer over HTTP sends a crafted request that exploits the vulnerability without any credentials or user interaction (AV:N/AC:L/PR:N/UI:N). Because the scope changes, a successful attack yields full read access to SOA-accessible data and limited modification, and can significantly impact additional co-located Fusion Middleware products. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.
RemediationAI
Apply the Oracle Critical Patch Update of October 2026 for Oracle SOA Suite to both the 12.2.1.4.0 and 14.1.2.0.0 installations - the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html lists the supported-version patches (patch availability per vendor advisory; exact patch numbers were not included in the supplied data, so confirm them against the CPU page before deployment). Until patching is complete, the highest-value compensating control is exposure reduction: terminate or filter access to the SOA Suite Fabric Layer HTTP endpoints at the perimeter or via a reverse proxy/WAF so only trusted administrative and integration subnets can reach them - this may break legitimate composite invocations and remote deployment tooling, so validate the allow-list against known integrations first. Because the defect is an authentication bypass, treat any pre-patch exposure window as a possible compromise: review Fabric Layer access logs for unauthenticated or anomalous requests, and rotate SOA Suite service accounts, WebLogic administrative credentials, and any credentials stored in the domain if suspicious activity is found, accepting the operational disruption that credential rotation entails. Restrict WebLogic administration and internal channels to dedicated management networks, and monitor for the deployment of the patch through your standard change-management process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Fabric Layer of Oracle SOA Suite, the runtime stratum that hosts SOA composites and service engines and exposes HTTP endpoints used for service invocation, deployment, and internal management within a WebLogic Server/Fusion Middleware domain. Oracle assigned no CWE, but the vendor metadata tag 'Authentication Bypass' points to a missing or improperly enforced authentication check on a Fabric Layer HTTP entry point (the class of CWE-306/CWE-287), which is consistent with the CVSS vector's PR:N/UI:N and with the high confidentiality impact. Because the vector carries S:C (scope change), the vulnerable component's privileges can be used to affect resources outside its own security authority - in practice, other Fusion Middleware products sharing the domain, the credential store, or the same network segment - so blast radius depends heavily on co-deployment topology. Attack complexity is low and no user interaction is required, meaning exploitation is a single-step network request rather than a chained or timing-dependent attack; the practical gating factor is reachability of the SOA Suite HTTP listener, which in many installations sits on internal or management networks rather than the public internet. No CPE data was supplied with the feed, so affected-product identification rests on the Oracle/EUVD version lists for 12.2.1.4.0 and 14.1.2.0.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated HTTP-reachable flaw with no user interaction gives AV:N/AC:L/PR:N/UI:N; scope change and full data read with partial write yield S:C/C:H/I:L/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Executive ViewAI
Oracle SOA Suite's Fabric Layer in versions 12.2.1.4.0 and 14.1.2.0.0 exposes a critical unauthenticated access-control bypass that can let network-reachable attackers read critical data and make limited unauthorized changes, with scope change indicating potential reach into other Fusion Middleware components. No public exploit identified at time of analysis, but the lack of authentication, user-interaction, and complexity prerequisites makes this a priority exposure-reduction and patch-readiness issue wherever the SOA HTTP interface is broadly reachable.
No vendor-released patch identified at time of analysis; restrict network access to the SOA Suite Fabric Layer HTTP interface to trusted networks, enforce WAF or virtual patching, segment Fusion Middleware components, enable enhanced logging and monitoring for authentication bypass and data access, and limit service account privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB