The vulnerability in Oracle Service Bus 14.1.2.0.0 allows a low‑privileged attacker with network connectivity over HTTP to gain full control of the server. An exploit can lead to complete compromise, exposing sensitive data and allowing the attacker to alter or delete the application and its configuration. The impact is severe, as confidentiality, integrity, and availability of the Service Bus are all heavily affected.

Oracle Service Bus version 14.1.2.0.0, provided by Oracle Corporation.

The CVSS v3.1 base score is 8.8, indicating high severity, with an attack vector of network (AV:N), low reachability (AC:L), low privilege (PR:L), no user interaction (UI:N), and universal scope (S:U) leading to complete confidentiality, integrity, and availability impacts (C:H I:H A:H). The EPSS score is less than 1%, suggesting a low probability of exploitation in recent data, and the vulnerability is not listed in the CISA KEV catalog. An attacker with basic privileges and HTTP network access can exploit this flaw without pre‑existing credentials, resulting in full compromise of the Service Bus.