This vulnerability exists in the Integration Business Insight component of Oracle SOA Suite, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, resulting in a scope change that may impact additional Oracle products. Successful exploitation leads to unauthorized access to critical or all data accessible through Oracle SOA Suite. The CVSS 3.1 base score is 7.7, reflecting high confidentiality impact with no impact on integrity or availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a fix for this specific vulnerability or provide detailed remediation instructions.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by Oracle SOA Suite, compromising confidentiality. There is no impact on data integrity or system availability. The vulnerability may also affect additional Oracle products due to scope change.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. Customers are strongly advised to monitor the vendor advisory for updates and apply any released patches promptly. Until an official fix is confirmed, restrict network access to Oracle SOA Suite HTTP interfaces to trusted users only and follow Oracle's general security recommendations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.