A vulnerability in the Oracle SOA Suite Fabric Layer allows an attacker who already has network access and only low‑level privileges to gain full control of the system. The flaw is an access control weakness that enables the attacker to invoke privileged operations over HTTP. Once exploited, the attacker can read, modify, and delete any data within the SOA Suite and ultimately assume ownership of the entire application, leading to loss of confidentiality, integrity and availability.

The affected product is Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, components of Oracle Fusion Middleware. The flaw resides specifically in the Fabric Layer of these versions.

The CVSS v3.1 score of 7.5 indicates high severity, and although an EPSS score is not available, the lack of an existing KEV listing does not preclude exploitation. An attacker can reach the vulnerable component over standard HTTP, and with only a low‑privilege account can trigger the weakness, achieving complete takeover. The risk is therefore significant for environments with exposed SOA Suite services.