CVE-2026-60538

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 29/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Oracle SOA Suite (Enterprise Scheduling System component) allows an unauthenticated attacker to remotely take over the system via HTTP. It requires only network access and no privileges or user interaction.

Risk Assessment

An attacker can gain full control of Oracle SOA Suite, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.

Original NVD description (English source)

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).