Easily exploitable vulnerability found in the Adapters component of Oracle SOA Suite allows an attacker with low privileges who can reach the system over HTTP to compromise the application. The description indicates that exploitation can lead to full takeover, impacting confidentiality, integrity, and availability of the SOA Suite instance. No indication of additional data leakage beyond the application is provided, but scope change means other components of the Oracle Fusion Middleware stack may also be adversely affected.

Affected are Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 from Oracle Corporation. These versions are listed as vulnerable in the Oracle Customer Vulnerability Alert for October 2026.

With a CVSS score of 9.9 the vulnerability is considered a high‑severity flaw. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalogue, but the base vector indicates that local privilege is low and the attacker only requires network connectivity, making the attack likely via HTTP. The likelihood of exploitation is therefore significant for unprotected deployments.