CVE-2026-60538
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Vulnerability in Oracle SOA Suite (Enterprise Scheduling System component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.
Risk Assessment
An attacker can gain full control of Oracle SOA Suite, leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.
Other vulnerabilities in Oracle SOA Suite
See all- CVE-2026-91251Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can take over the product, and attacks may significantly impact additional products (scope change).
- CVE-2026-91250Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via multiple protocols can take over the product, and attacks may significantly impact additional products (scope change).
- CVE-2026-91236Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91235Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91234Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91233Critical
Vulnerability in Oracle SOA Suite (Enterprise Scheduling System component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via SOAP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91232Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows a low-privileged attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91231Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite, with potential impact on additional products (scope change). CVSS 3.1 Base Score 10.0.
- CVE-2026-91230Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily gain unauthorized access to critical data or all Oracle SOA Suite accessible data and unauthorized update, insert, or delete access to some data, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.3.
- CVE-2026-91225Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily gain unauthorized creation, deletion, or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 9.1.
Original NVD description (English source)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS