EUVD-2026-106493
GHSA-cf85-v7xr-rmgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SOA account
-
DeliveryReach Fabric Layer over HTTP
-
ExploitSend crafted request to exploit flaw
-
ExecutionTamper with or delete critical data
-
ImpactIntegrity loss plus partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on the target Oracle SOA Suite instance (CVSS PR:L) and HTTP/network reachability to the Fabric Layer component; affected builds are 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the authentication requirement is the key limiting factor - fully unauthenticated attackers cannot exploit it, so exposure is driven by how broadly low-privilege SOA accounts are provisioned and whether the management/HTTP interface is network-restricted. Impact is confined to integrity (data creation/deletion/modification) and partial availability; confidentiality is not affected. |
| Impact | This is a genuine-but-moderate priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high integrity impact and low availability impact with no confidentiality loss - consistent with the description of unauthorized create/delete/modify of critical data plus partial DoS. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so this is no public exploit identified at time of analysis; it should not be treated as actively exploited. No SSVC decision data was supplied. The one signal that could elevate urgency - the PR:L requirement - means an attacker still needs some authenticated foothold, which tempers the network-vector risk. The 'Denial Of Service' tag aligns only with the A:L (partial DoS) portion and understates the more significant I:H (integrity) impact; the primary danger is data tampering, not availability. Net: patch within normal Oracle CPU cadence; not an emergency absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on an internet- or network-reachable Oracle SOA Suite instance sends crafted HTTP requests to the Fabric Layer component. By abusing the flaw they modify or delete critical SOA composite/runtime data and can induce a partial denial of service of the suite. No public proof-of-concept is referenced, and exploitation requires valid (if low-level) credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged attacker with HTTP access to the Fabric Layer to create, delete, or modify critical data and cause a partial denial of service. The CVSS 3.1 vector requires a valid low-privileged account (PR:L) but no user interaction, and confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, so priority is driven by exposure of low-privilege SOA accounts and the HTTP interface.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in Oracle's October 2026 security alert (https://www.oracle.com/security-alerts/cpuoct2026.html) for Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0; the advisory is the authoritative source for the exact patched build because the input data does not include specific fixed version numbers. Until patched, restrict HTTP access to the Fabric Layer to trusted networks and administrative hosts, enforce least privilege, review and reduce low-privileged SOA accounts, and monitor for anomalous create/delete/modify activity or partial service disruptions. These controls reduce exposure but do not eliminate the flaw, and network restrictions can break legitimate SOA integrations that rely on Fabric Layer endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle SOA Suite is Oracle Fusion Middleware's service-oriented architecture platform; the affected Fabric Layer is the component exposed over HTTP in this advisory. The supplied data provides no CWE, so the code-level defect class is not disclosed, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) describes a network-reachable, low-complexity flaw that requires a valid low-privileged account and causes high integrity impact plus partial availability impact while leaving confidentiality intact. In practice this points to an access-control or authorization weakness in Fabric Layer operations that a low-privileged user can invoke to alter or delete SOA data and degrade service; no CPE identifiers were supplied to narrow the affected product set beyond the EUVD-listed SOA Suite versions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
HTTP-reachable Fabric Layer gives AV:N/AC:L; a low-privilege account is required (PR:L); impact is data tampering (I:H) with partial DoS (A:L) and no confidentiality loss (C:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Executive ViewAI
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 create a high-severity integrity and availability risk for organizations running business-critical SOA integrations, because an authenticated low-privileged user with HTTP access to the Fabric Layer could alter or remove critical data and partially disrupt services. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so leadership attention should focus on reducing exposure of low-privileged SOA accounts and the Fabric Layer HTTP interface while maintaining integration trust and service continuity.
No vendor-released patch identified at time of analysis; restrict Fabric Layer HTTP access to trusted networks or hosts, enforce least privilege and recertify low-privileged SOA accounts, rotate credentials, deploy WAF/API gateway rules, enable detailed audit logging and alerting for create/delete/modify operations, and maintain tested backups of critical SOA data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB