EUVD-2026-46903
GHSA-xpm7-m2r7-wpxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SOA Suite/ESS HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger flaw in Enterprise Scheduling System
-
ExecutionGain full control of SOA Suite
-
ImpactExfiltrate data and disrupt services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is HTTP network reachability to the Oracle SOA Suite Enterprise Scheduling System component on an affected version (12.2.1.4.0 or 14.1.2.0.0) - no special configuration is described. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there is no special condition: remote unauthenticated exploitation is possible against affected Oracle SOA Suite deployments whose ESS/SOA HTTP endpoints are reachable by the attacker. The primary limiting factor is exposure - deployments where the SOA/ESS application tier sits behind a firewall or VPN and is not internet-facing materially reduce realistic attack surface, and only the two named versions are confirmed affected. |
| Impact | All available signals point to high real-world risk rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, no authentication, no user interaction, and full triple impact - the easiest-to-exploit profile that exists. There is no EPSS score, no CISA KEV listing, and no SSVC decision data in the input, so exploitation probability and automatability cannot be quantified from the provided sources; the vendor 'Tags' label of 'Information Disclosure' understates the described 'takeover' impact and conflicts with the C:H/I:H/A:H vector, so the vector should be treated as authoritative. Absence of KEV/EPSS is a data gap, not evidence of low risk: for an unauthenticated Oracle middleware RCE-class flaw, exposure of the ESS endpoint to untrusted networks should be treated as an urgent priority. |
| Exploit ScenarioDerived | An attacker who can reach the SOA Suite application tier over HTTP sends a single crafted request to the Enterprise Scheduling System endpoint, requiring no credentials and no user interaction, and gains full control of the SOA Suite instance. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, mass scanning of internet-exposed Oracle Fusion Middleware hosts followed by opportunistic exploitation is realistic. No public proof-of-concept was identified in the provided data, but the low complexity means one could appear quickly after patch analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes CPU patches per product version and stack, so administrators should map their exact 12.2.1.4.0 or 14.1.2.0.0 deployment to the corresponding CPU patch (no single fixed version string is provided in the input, so cite the CPU rather than an invented version). Until patching completes, restrict network access to the Enterprise Scheduling System / SOA HTTP endpoints so they are reachable only from trusted management networks (via firewall rules, WebLogic connection filters, or a reverse-proxy allowlist), and remove any direct internet exposure of the SOA/ESS application tier; the trade-off is that legitimate remote integration clients and scheduled-job consumers must be explicitly allowlisted, which can break automated jobs if their source addresses are not accounted for. Monitor the SOA/WebLogic access logs for anomalous requests to ESS URLs as a compensating detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle SOA Suite is a middleware platform within Oracle Fusion Middleware used to build, deploy, and manage service-oriented and integration workflows (BPEL, mediator, business rules). The affected element is the Enterprise Scheduling System (ESS/Oracle Enterprise Scheduler), the component responsible for defining and running scheduled batch jobs across Fusion Middleware and Fusion Applications, typically reachable over HTTP through the WebLogic-hosted application tier. Oracle's advisory does not assign a CWE (CWE: N/A) and provides no technical root-cause detail; based on the 'takeover' outcome and unauthenticated network vector, the flaw is most consistent with a pre-authentication injection or deserialization/remote-code-execution class defect exposed by the ESS HTTP endpoints, though the exact weakness is not published.
Know when Soa Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated HTTP-reachable takeover with no user interaction, so AV:N/AC:L/PR:N/UI:N, and full product compromise yields C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 expose the Enterprise Scheduling System to unauthenticated remote complete takeover, creating immediate risk of total infrastructure compromise for any organization running these versions. With no available vendor patches and the straightforward nature of the attack, exploitation is highly likely despite no current public exploit code. This vulnerability requires emergency response and interim risk controls to protect enterprise integration operations.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation restricting Enterprise Scheduling System access to trusted internal networks only, HTTP request filtering or WAF rules to limit ESS component exposure, disabling the ESS service if not operationally critical, and enhanced logging and monitoring for anomalous traffic to ESS endpoints. These measures reduce attack surface but do not eliminate risk and must be replaced with vendor patches immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System com
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attack
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine c
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated high sev
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Eng
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attack
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0,
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Rated high severity (CV
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resulta
Exploit-DB