Soa Suite
Monthly
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine component via HTTP, with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, covering both the long-term supported and newer release trains of this enterprise middleware. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability - consistent with a complete compromise scenario. No public exploit or CISA KEV listing has been identified at time of analysis.
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged attacker with network HTTP access to affected deployments (versions 12.2.1.4.0 and 14.1.2.0.0) can fully compromise confidentiality, integrity, and availability. Oracle rates this CVSS 8.8 and disclosed it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, but the low attack complexity and "easily exploitable" language make it a high-priority patching target. Any authenticated user of the middleware stack - not just administrators - can reach the flaw.
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Health Care FastPath). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine component via HTTP, with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, covering both the long-term supported and newer release trains of this enterprise middleware. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability - consistent with a complete compromise scenario. No public exploit or CISA KEV listing has been identified at time of analysis.
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged attacker with network HTTP access to affected deployments (versions 12.2.1.4.0 and 14.1.2.0.0) can fully compromise confidentiality, integrity, and availability. Oracle rates this CVSS 8.8 and disclosed it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, but the low attack complexity and "easily exploitable" language make it a high-priority patching target. Any authenticated user of the middleware stack - not just administrators - can reach the flaw.
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Health Care FastPath). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.