A low‑privileged attacker who can reach the Oracle SOA Suite Fabric Layer over HTTPS can modify, delete or insert data, read sensitive information, and trigger a partial denial of service. These privileges lead to loss of confidentiality, integrity, and availability for parts of the application. The weakness enables unauthorized access and changes to data that the attacker should not be able to perform.

Oracle Corporation’s Oracle SOA Suite product versions 12.2.1.4.0 and 14.1.2.0.0 are impacted. End users of these releases must verify their deployment for the specific software components named in the advisory.

The CVSS 3.1 base score of 5.0 indicates a moderate severity risk, with exploitation possible over a network connection and requiring an account with low privileges. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must authenticate to an HTTPS endpoint; the attack vector is inferred to be remote network access to the Fabric Layer. No additional local access or privilege escalation beyond the existing low‑privilege account is required for exploitation.