CVE-2026-60540
A critical flaw in Oracle SOA Suite’s Integration Business Insight component lets attackers with network access create, delete, or modify data without authentication. The vulnerability can be triggered over HTTP and can affect all data stored in the suite. It is rated CVSS 9.6, indicating a high risk to confidentiality and integrity.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle SOA Suite (Oracle Fusion Middleware) – Integration Business Insight component – versions 12.2.1.4.0 and 14.1.2.0.0. Users running these versions are at risk.
Real-world impact
An attacker could gain unauthorized access to, alter, or delete critical data stored in Oracle SOA Suite, potentially compromising business processes and sensitive information.
Why this severity
The CVSS score of 9.6 comes from the fact that the flaw is network‑based, requires only low privileges, and can change the confidentiality and integrity of data. The attack is easy to execute and can affect all data in the system, which is why the score is high.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory