Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Oracle SOA Suite’s Fabric Layer contains a flaw that allows an unauthenticated attacker with HTTP network access to gain full control of the system. The vulnerability is easily exploitable and results in a complete takeover, impacting confidentiality, integrity, and availability at the highest severity. The weakness is related to improper access control and credential validation, as indicated by the CWE identifiers.

Affected Systems

The affected product is Oracle SOA Suite, versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware. These versions include the Fabric Layer component, which is the locus of the vulnerability.

Risk and Exploitability

The CVSS v3.1 base score of 9.8 classifies this as critical, and no authentication is required, meaning any host with network connectivity to the SOA Suite instance can attempt an exploit. The EPSS score is less than 1%, indicating a low probability of observed exploitation, but the combination of unrestricted network exposure and the high severity score makes the overall risk severe. The vulnerability is not listed in CISA’s KEV catalog, so no public exploits are known, but the potential for undetected exploitation remains high.

Generated by OpenCVE AI on October 22, 2026 at 07:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch released in the Oracle CPU Oct 2026 update.
  • If the patch cannot be applied immediately, block HTTP traffic to the SOA Suite instance from all non‑trusted hosts using firewall rules or network segmentation.
  • Monitor audit logs for suspicious activity and isolate affected services until the patch is applied.

Generated by OpenCVE AI on October 22, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle SOA Suite Fabric Layer
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle SOA Suite Fabric Layer
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:18.473Z

Reserved: 2026-09-14T22:10:16.615Z

Link: CVE-2026-91214

cve-icon Vulnrichment

Updated: 2026-10-21T10:54:27.752Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:21.787

Modified: 2026-10-30T14:25:36.390

Link: CVE-2026-91214

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T08:00:04Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function