Oracle SOA Suite’s Fabric Layer contains a flaw that permits an attacker with only network connectivity to the T3 or IIOP interfaces to execute actions without authentication, enabling a full compromise of the target instance. The impact is three‑fold, affecting confidentiality, integrity, and availability, and potentially allowing an attacker to take over the entire SOA Suite environment.

Affected are Oracle SOA Suite version 12.2.1.4.0 and 14.1.2.0.0. These releases are part of Oracle Fusion Middleware, and the vulnerability may propagate to other dependent products because the exploitation changes the scope of trust for the entire stack.

The flaw carries a CVSS 3.1 score of 10.0, indicating critical severity. EPSS score is < 1%, indicating a very low but nonzero probability that the vulnerability will be exploited, but given the vulnerability’s simplicity and lack of authentication requirements, the condition is still likely to be used. The vulnerability is not listed in the CISA KEV catalog, however it is easily exploitable over the network, which means an unauthenticated attacker can gain control of the target without requiring privileged credentials.