A flaw in the Fabric Layer of Oracle SOA Suite allows an unauthenticated attacker with network HTTP access to compromise the entire application. This weakness involves both missing authentication (CWE‑287) and authorization bypass through user‑controlled key (CWE‑306). It is easily exploitable and can lead to full takeover, resulting in loss of confidentiality, integrity, and availability. The CVSS v3.1 score of 9.8 indicates severe risk.

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These releases are part of Oracle’s Fusion Middleware suite and may be deployed in enterprise integration scenarios.

The CVSS score of 9.8 highlights a critical risk level, and the EPSS score of <1% indicates a low probability of exploitation, but the vulnerability still represents a significant threat. The attack vector is network based, specifically HTTP, and requires no credentials. The lack of a KEV listing does not mitigate the risk, as the vulnerability can be leveraged by attackers with sufficient access to the network fully exposing the environment. The description indicates that the vulnerability can be exploited by unauthenticated network traffic, suggesting a straightforward entrypoint for attackers. Threat actors could directly target the SOA endpoints or attempt to enumerate the services via standard web traffic. Given the severity and the availability of a network‑based exploitation path, the risk must be treated as imminent for any exposed installation.