An unauthenticated network attacker can exploit the Fabric Layer component of Oracle SOA Suite to obtain unauthorized access to stored data. The vulnerability reflects multiple weaknesses, including information disclosure (CWE‑200) and unauthorized access due to improper authentication and authorization (CWE‑306), allowing the attacker to bypass authentication and authorization controls, potentially exposing sensitive information or granting full access to all data available to the application.

The flaw affects Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0. Users deploying these releases must verify that they are running either of the affected versions and assess whether additional Fusion Middleware products may be impacted due to scope changes.

The CVSS v3.1 score of 8.6 indicates a high severity vulnerability. Based on the description, it is inferred that the likely attack vector requires network access over HTTP, with no authentication or user interaction needed. The vector also indicates a scope change, implying that exploitation could affect resources beyond the immediate target. Because the vulnerability is easy to exploit and the attacker needs only network access to the SOA Suite instance, the risk is high. The EPSS score of < 1% indicates a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a mitigation still poses a significant threat to organizations running the affected releases.