The vulnerability resides in the Fabric Layer of Oracle SOA Suite and allows an attacker with low privileges and network access via HTTP to compromise the product. Successful exploitation can lead to full takeover, resulting in loss of confidentiality, integrity and availability of the application. The CVSS 3.1 base score of 7.5 indicates a high severity condition involving low attack complexity and no user interaction, underscoring the ease of exploitation.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

The CVSS score of 7.5 signals considerable risk and the lack of an EPSS score means current exploitation probability is unknown but could be high given the nature of the flaw. The vulnerability is not listed in the CISA KEV catalog yet, but its potential to allow remote takeover makes it a critical concern. The likely attack vector is a network-based HTTP request from a low‑privileged attacker, exploiting the Fabric Layer’s inadequate access controls.