Oracle Soa Suite vulnerabilities

18 CVEs affecting Oracle Soa Suite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61002, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2019-17359, published 2019-10-08. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
CVE-2018-1000613, published 2018-07-09. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code…
CVE-2018-1000180, published 2018-06-05. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added…
CVE-2017-10026, published 2017-10-19. High severity, CVSS 8.2. EPSS: 1.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). The supported version that is affected is 11.1.1.7.0. Easily exploitable vulnerability allows…
CVE-2019-2572, published 2019-04-23. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows…
CVE-2018-3105, published 2018-07-18. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Health Care FastPath). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0,…
CVE-2022-21622, published 2022-10-18. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability…
CVE-2022-21562, published 2022-07-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable…
CVE-2026-60541, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…

Latest

CVE-2026-61002, published 2026-08-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2026-60548, published 2026-07-21. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60546, published 2026-07-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60544, published 2026-07-21. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable…
CVE-2026-60543, published 2026-07-21. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit…
CVE-2026-60540, published 2026-07-21. Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60539, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60538, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…