Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle SOA Suite contains a flaw in its Enterprise Scheduling System that lets an unauthenticated attacker send crafted HTTP requests to the system. The absence of authentication checks allows the attacker to execute arbitrary code on the host, resulting in a full takeover of the affected Oracle SOA Suite instance. This compromises confidentiality, integrity, and availability.

Affected Systems

This issue affects Oracle Corporation’s Oracle SOA Suite (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability resides in the Enterprise Scheduling System component of these releases.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 indicates a severe impact on all three core security properties. The EPSS score of less than 1% suggests exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. Nonetheless, the vulnerability is described as easily exploitable. If an attacker can reach the affected Enterprise Scheduling System over HTTP from an unauthenticated position, they can run arbitrary code and fully compromise the appliance.

Generated by OpenCVE AI on August 4, 2026 at 03:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle SOA Suite patch released in the July 2026 CPU to address the Enterprise Scheduling System vulnerability.
  • Block HTTP access to the affected Enterprise Scheduling System endpoints from untrusted networks using firewalls or access control lists.
  • Monitor logs for anomalous requests to the Enterprise Scheduling System to detect exploitation attempts.

Generated by OpenCVE AI on August 4, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution via Enterprise Scheduling System in Oracle SOA Suite

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution via Enterprise Scheduling System in Oracle SOA Suite

Mon, 27 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle SOA Suite Enterprise Scheduling System
Weaknesses CWE-284

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle SOA Suite Enterprise Scheduling System
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T18:01:33.440Z

Reserved: 2026-07-08T15:51:40.543Z

Link: CVE-2026-60538

cve-icon Vulnrichment

Updated: 2026-07-24T18:01:11.207Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:45:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function