This vulnerability in the Fabric Layer of Oracle SOA Suite permits an attacker with network access to send unauthenticated HTTP requests that read data stored by the suite. The flaw results from insufficient authentication and authorization controls, aligning with CWE-200 and CWE-306. No credentials are required, making the vulnerability straightforward to exploit and delivering a high confidentiality impact, as reflected by a CVSS score of 8.6.

The vulnerability affects Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0, specifically the Fabric Layer component within Oracle Fusion Middleware. These versions are susceptible to unauthenticated HTTP data access.

The CVSS base score of 8.6 signals high severity. The EPSS score is reported as less than 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation campaigns are known. An attacker can exploit the issue by targeting the Fabric Layer endpoints over standard HTTP without authentication, potentially reading critical configuration and business data and gaining full access to all data available to the SOA Suite instance. The potential scope change may impact other Fusion Middleware components that rely on the Fabric Layer.