Vulnerability in the Fabric Layer of Oracle SOA Suite enables a low‑privileged attacker with network access via HTTP to fully compromise the application. The flaw allows the attacker to bypass normal authentication controls and execute arbitrary code, leading to a complete takeover of the SOA Suite instance. The CVSS 3.1 base score is 8.8 and the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the exploit is easy, requires only local user rights, and has significant impacts on confidentiality, integrity and availability.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These are part of Oracle Fusion Middleware and are typically deployed in enterprise integration environments. The vulnerability exists in the Fabric Layer component of these releases.

The high CVSS score indicates a serious threat; the lack of an EPSS score means current exploit availability is unknown, but the absence from KEV does not diminish the risk of targeted attacks. The attack vector is network‑based over HTTP, and the low privilege requirement means that any user with basic access to the SOA servers can take advantage of the flaw. Successful exploitation results in full control over the application, which can lead to data theft, tampering or denial of service for all services hosted on the affected SOA Suite instance.