Vulnerability in the Fabric Layer of Oracle SOA Suite allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The flaw enables compromise of all accessible data within the suite and results in a high confidentiality impact, as defined by a CVSS 3.1 Base Score of 7.5.

The affected products are Oracle SOA Suite version 12.2.1.4.0 and version 14.1.2.0.0, as distributed by Oracle Corporation.

The CVSS score indicates a high severity vulnerability, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The risk remains primarily driven by the fact that the flaw can be exploited by any actor with network connectivity. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a simple, unauthenticated HTTP request to the affected system.