The vulnerability resides in the Fabric Layer of Oracle SOA Suite and permits a low‑privileged attacker who can reach the system over HTTP to gain access to sensitive data, and in some cases to grant themselves full control over all data that the SOA Suite exposes. This results in confidentiality compromises and potential integrity violations, such as unauthorized updates, insertions, or deletions of data. The weakness is an improper access control flaw.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected. Administrative staff managing these environments should verify which of these product releases are in use and evaluate the necessity of the Fabric Layer for their functions.

The CVSS base score is 7.1, indicating a high magnitude of potential impact. The EPSS score is < 1%, and the CVE is not listed in CISA’s KEV catalog, suggesting that active exploitation is not yet confirmed. Nonetheless, the likely attack surface is the exposed HTTP interface, where a network‑accessible attacker with minimal privileges can exploit the flaw. The most probable path involves sending crafted HTTP requests that trigger the Fabric Layer to bypass normal authorization checks, culminating in unauthorized data read, write, or deletion capabilities. Given the public disclosure and the potential for widespread exposure, the risk remains significant.