A critical vulnerability exists in Oracle Service Bus that allows a low‑privileged attacker with network access via HTTP to take control of the application. The flaw is exploitable in a straightforward manner, leading to a complete compromise and the potential for arbitrary code execution, with severe impacts on confidentiality, integrity, and availability of all data and services managed by the service bus.

The affected products are Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0. These versions are part of Oracle Fusion Middleware and are commonly deployed in enterprise integration environments.

The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified, but the lack of advanced defenses and the ease of exploitation reduce the barrier to attack. The CVE is not listed in the CISA KEV catalog, yet its impact and potential for widespread compromise suggest it should be considered a significant threat. The attack vector is inferred to be network‑based via HTTP, as the description specifies network access is required and the vulnerability can be triggered without privileged authentic credentials.}