The vulnerability is located in the Fabric Layer of Oracle SOA Suite, arising from a resource exhaustion flaw (CWE‑400). It allows an attacker with only low privilege but network access via HTTP to perform unauthorized creation, deletion or modification of critical data, and to trigger a partial denial of service. The exploit does not directly disclose data but compromises the integrity and availability of the application.

Affected are Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0, both part of Oracle Fusion Middleware released by Oracle Corporation.

The CVSS 3.1 base score of 7.1 indicates a high severity with impact on integrity and availability. The EPSS score of < 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a low-privilege attacker with network access over HTTP, implying that the vulnerability can be exploited without elevated privileges or exploitation of a local vulnerability. The combination of a moderate to high CVSS score and a readily accessible network path means organizations using these versions are at significant risk of data integrity compromise and partial service disruption if the issue is left unmitigated.