The Oracle SOA Suite vulnerability in the Enterprise Scheduling System allows an unauthenticated attacker to send a crafted SOAP request over the network, leading to remote code execution that can fully compromise the SOA Suite instance. This flaw results in complete loss of confidentiality, integrity, and availability, enabling the attacker to execute arbitrary code, modify or delete data, and disrupt services.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These deployments are part of Oracle Fusion Middleware and are commonly used for orchestrating enterprise services. The vulnerability resides in the Enterprise Scheduling System component, which handles SOAP-based scheduling requests.

The CVSS 3.1 base score of 9.8 marks this flaw as critical. The EPSS score of < 1% indicates a low overall probability of exploitation, yet the lack of an authentication requirement means any network user that can reach the exposed SOAP endpoint can attempt the attack. The vulnerability is not listed in CISA KEV, but environments with public or poorly protected SOAP interfaces remain at significant risk of a successful, unauthenticated exploit that would grant full control of the SOA Suite.