Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Access Control Bypass
Action: Immediate Patch
AI Analysis

Impact

This vulnerability resides in the Fabric Layer of Oracle SOA Suite. A low‑privileged user who can reach the application over HTTP can exploit the flaw to create, delete, or modify critical data, effectively gaining full control over the suite’s data. The vulnerability violates confidentiality and integrity, reflected in a CVSS base score of 9.6 and represents an Improper Access Control problem that allows bypass of authentication and authorization checks.

Affected Systems

Affected are Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0, part of the Oracle Fusion Middleware family. Because the flaw’s scope expands beyond the suite, other Oracle products that interact with the SOA Suite may also be impacted.

Risk and Exploitability

The CVSS rating of 9.6 and the network reachability (AV:N) with low attacker effort make this flaw highly exploitable. The EPSS score of < 1% suggests a low probability of exploitation at this time, but the absence of complex prerequisites still allows an attacker to readily leverage the flaw to compromise data or the entire application. Although it is not listed in the CISA KEV catalog, the severity and potential cross‑product impact warrant urgent remediation.

Generated by OpenCVE AI on October 30, 2026 at 19:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle SOA Suite patch released in the October 2026 security update
  • Restrict HTTP access to administrative and Fabric Layer endpoints by implementing network segmentation or firewall rules to limit exposure to trusted hosts
  • Verify that all API endpoints enforce proper authentication and authorization checks to prevent unauthorized data manipulation and monitor logs for suspicious activity that may indicate exploitation attempts

Generated by OpenCVE AI on October 30, 2026 at 19:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Access Allows Unauthorized Data Modification in Oracle SOA Suite

Fri, 30 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title Fabric Layer Access Control Bypass in Oracle SOA Suite
Weaknesses CWE-285

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Thu, 29 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title Fabric Layer Access Control Bypass in Oracle SOA Suite
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T16:55:23.261Z

Reserved: 2026-09-14T22:10:16.615Z

Link: CVE-2026-91218

cve-icon Vulnrichment

Updated: 2026-10-29T16:55:17.904Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:22.240

Modified: 2026-10-30T14:25:11.820

Link: CVE-2026-91218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T20:00:16Z

Weaknesses