This vulnerability in Oracle SOA Suite's B2B Engine allows an unauthenticated remote attacker to compromise the system via HTTP network access. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm patch availability or remediation level for this specific vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to a complete takeover of Oracle SOA Suite, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to access sensitive data, modify or disrupt business processes managed by the SOA Suite.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities, including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60543. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security updates promptly. Until patches are confirmed and applied, organizations should consider restricting network access to Oracle SOA Suite HTTP interfaces to trusted sources only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.