CVE-2026-60544 is a vulnerability in the Oracle SOA Suite B2B Engine component affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, leading to unauthorized access to critical or all accessible data and enabling a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this and many other vulnerabilities but does not explicitly confirm a dedicated patch for this CVE. Customers are advised to apply the Critical Patch Update to address this and other security issues.

Successful exploitation of this vulnerability can result in unauthorized access to critical or all data accessible through Oracle SOA Suite and can cause a partial denial of service condition. The confidentiality impact is high, while integrity impact is not affected, and availability impact is low. This could lead to significant data exposure and service disruption within affected Oracle SOA Suite environments.

Oracle has released a Critical Patch Update advisory in July 2026 that includes multiple security patches. Although no explicit patch for CVE-2026-60544 is detailed in the advisory content, Oracle recommends applying the Critical Patch Update promptly to mitigate this vulnerability along with others. Users should remain on actively supported versions and apply all available security patches without delay. Patch status is not yet confirmed specifically for this CVE; check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.