EUVD-2026-46900
GHSA-3rvh-mmrx-54vf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SOA/ESS HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitExploit ESS component flaw
-
ExecutionGain code execution on SOA Suite
-
ImpactFull instance takeover and data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0), consistent with AV:N/AC:L/PR:N/UI:N. The specific prerequisite is that the Enterprise Scheduling System (ESS) component must be deployed and its HTTP endpoint reachable by the attacker. The primary limiting factors are therefore network reachability of the SOA/ESS HTTP interface - instances isolated on internal-only management networks or behind authenticating proxies are far less exposed - and running one of the two affected supported versions; other version families are not listed as affected in the provided data. |
| Impact | All available signals point to genuine high priority rather than an inflated CVSS: the vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H, meaning trivial, unauthenticated, remote, single-request exploitation resulting in complete compromise. However, key corroborating signals are missing from the input: no EPSS probability, no KEV status, no SSVC decision data, and no CWE, so the exploitation likelihood cannot be quantified. There is a notable conflict between Oracle's 'Information Disclosure' tag and the description's 'takeover' language plus C:H/I:H/A:H - the impact metrics and 'takeover' wording should be trusted over the tag. No public exploit has been identified and the CVE is not confirmed in CISA KEV, so this is currently a high-severity, high-exposure issue without confirmed active exploitation. Given SOA Suite's typical role in integration backends, network-reachable ESS endpoints elevate real-world risk substantially. |
| Exploit ScenarioDerived | An attacker with only network reachability to a SOA Suite server sends a crafted HTTP request to an exposed Enterprise Scheduling System endpoint and, without any credentials or user interaction, achieves full compromise of the SOA Suite instance and its data. Because AC is low and no privileges are required, the attack is a single reliable request and would be readily automatable if exploit code emerges; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, referenced at https://www.oracle.com/security-alerts/cpujul2026.html - this is the authoritative source for the exact patch/bundle numbers for SOA Suite 12.2.1.4.0 and 14.1.2.0.0; note that Patch available per vendor advisory (Oracle CPU July 2026), but no exact fix version string is included in the provided data, so confirm the precise patch level from the CPU matrix rather than assuming a version. Because the vulnerable surface is the Enterprise Scheduling System reachable over HTTP, prioritize compensating controls until patching completes: restrict network access to the SOA/ESS WebLogic HTTP and management ports so only trusted management networks can reach them (trade-off: may break legitimate scheduled-job integrations that call ESS remotely), place the endpoints behind a reverse proxy or WAF that blocks unauthenticated access to /ess and SOA composite URLs, and remove any unnecessary internet exposure of the WebLogic managed servers. Avoid undeploying ESSAPP unless you have confirmed no dependent Fusion Middleware jobs rely on it, as that will disable scheduled job execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle SOA Suite is a middleware platform within Oracle Fusion Middleware used to build, deploy, and manage service-oriented architecture (SOA) composite applications, integrations, and orchestrations. The affected component is the Enterprise Scheduling System (ESS/ESSAPP), which schedules and executes background jobs for Fusion Middleware and Fusion Applications and is typically exposed through WebLogic-hosted HTTP endpoints. Oracle's advisory does not publish a CWE (CWE=N/A in NVD) and provides no technical root-cause detail, but the 'takeover' impact combined with an unauthenticated HTTP vector is consistent with the deserialization, injection, or authentication-bypass classes historically seen in WebLogic/SOA components. The Oracle-supplied tag 'Information Disclosure' understates the stated full C/I/A takeover impact and should be treated with caution.
Know when Soa Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network HTTP access with no user interaction yielding full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H are justified.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle SOA Suite deployments (versions 12.2.1.4.0 and 14.1.2.0.0) face critical risk from unauthenticated remote code execution in the Enterprise Scheduling System, enabling attackers to achieve complete system compromise via standard HTTP channels. Organizations running these versions require immediate risk mitigation as no vendor-released patch is available at this time. This vulnerability directly threatens operational continuity, data confidentiality, and system integrity across all integrated business processes dependent on SOA Suite.
No vendor-released patch identified at time of analysis. Interim mitigations include: network isolation of affected systems from untrusted networks, HTTP access restriction via firewall rules to pre-approved administrative IPs only, web application firewall rules to detect anomalous requests to Enterprise Scheduling System endpoints, disabling the Enterprise Scheduling System component if not operationally critical, implementation of real-time log monitoring with alerts for unauthorized access attempts, network traffic inspection for SOA Suite communication anomalies, and expedited evaluation of upgrade paths to supported Oracle Fusion Middleware versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer over
Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric L
Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be re
Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installat
Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer compo
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attack
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication
Exploit-DB