Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-10-20
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Integrity and Availability compromise via unauthenticated remote HTTP access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in the Adapters component of Oracle SOA Suite enables an unauthenticated attacker with network access via HTTP to create, delete, or modify critical data, as well as force the system to hang or crash. These impacts result in significant integrity loss and a complete denial of service, reflected in a CVSS 3.1 score of 9.1.

Affected Systems

Oracle Corporation’s Oracle SOA Suite, specifically versions 12.2.1.4.0 and 14.1.2.0.0, are affected.

Risk and Exploitability

The CVSS base score of 9.1 indicates a severe risk, and the vulnerability is considered easily exploitable because it requires only network connectivity without authentication. The EPSS score of less than 1% indicates that the probability of exploitation is very low, yet the high severity and lack of mitigations in the wild suggest a notable overall risk. The vulnerability is not listed in the CISA KEV catalog, but the potential impact warrants prompt attention and remediation.

Generated by OpenCVE AI on October 30, 2026 at 17:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a version that contains the fix for the Adapters component.
  • Configure firewall rules or network segmentation to restrict HTTP access to the Oracle SOA Suite services, limiting exposure to trusted hosts only.
  • Disable unused adapters and restrict privileged operations to a narrow set of authorized users to reduce the attack surface.

Generated by OpenCVE AI on October 30, 2026 at 17:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Tampering and DoS in Oracle SOA Suite

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Tampering and DoS in Oracle SOA Suite
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T18:10:39.054Z

Reserved: 2026-09-14T22:10:16.616Z

Link: CVE-2026-91225

cve-icon Vulnrichment

Updated: 2026-10-29T18:10:20.753Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:23.043

Modified: 2026-10-30T14:24:49.470

Link: CVE-2026-91225

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T17:45:15Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function