CVE-2017-3507: Vulnerability in the Oracle Service Bus component of Oracle Fusion Middleware (subcomponent: Web Console De...

Security readout for executives and security teams

CVE-2017-3507 lets an unauthenticated network attacker reach Oracle Service Bus over HTTP and compromise part of the service. The stated business risk is unauthorized data changes, limited data disclosure, and partial service disruption in affected Oracle Fusion Middleware deployments. Exposure is most likely where affected Oracle Service Bus versions are deployed and reachable over HTTP, especially if the web console is accessible from broad internal networks or the internet. Treat this as high priority for any exposed or business-critical Oracle Service Bus deployment. It is unauthenticated, network reachable, and can affect data integrity and availability, but provided evidence does not show confirmed active exploitation. Mitigation focus: Check Oracle's April 2017 Critical Patch Update guidance for the supported fix path.; Restrict HTTP access to Oracle Service Bus web console to trusted administrative networks.; Remove any internet exposure for affected Oracle Service Bus management interfaces..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.