A flaw in the B2B Engine component of Oracle SOA Suite, classified as CWE-306 (Missing Authentication for Critical Function), allows an unauthenticated attacker to exploit the system via network HTTP access, potentially leading to full takeover of the application. The vulnerability carries Confidentiality, Integrity, and Availability impacts as reflected in the CVSS 8.1 rating, indicating that an attacker could gain unrestricted control, exfiltrate data, and disrupt service.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These are part of Oracle Fusion Middleware. The issue is specific to the B2B Engine component within these product releases.

Because the attack requires only network access over HTTP and no authentication, the vulnerability has a high potential for exploitation. The CVSS score of 8.1 signals a high severity. The EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog, meaning no known active exploitation is documented. Nevertheless, the critical nature of remote code execution warrants immediate attention.