This vulnerability in Oracle SOA Suite (Integration Business Insight component) allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle SOA Suite. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly confirm patch availability or remediation level for these versions.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle SOA Suite, as well as unauthorized access to all data accessible by the product. The vulnerability has a critical severity with a CVSS score of 9.6, indicating significant confidentiality and integrity impacts. There is no reported impact on availability. The vulnerability's scope change means it may also affect additional Oracle products beyond SOA Suite.

The Oracle Critical Patch Update Advisory for July 2026 includes multiple security patches addressing vulnerabilities across Oracle products. However, the advisory does not explicitly confirm the availability of a patch or remediation for CVE-2026-60540 in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply security patches promptly. Until an official fix is confirmed and applied, restrict network access to Oracle SOA Suite instances to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.