Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote takeover of Oracle SOA Suite
Action: Apply patch
AI Analysis

Impact

An insecure implementation in the Fabric Layer of Oracle SOA Suite allows a low privileged attacker with network access via HTTP to fully compromise the application. The weakness leads to a complete takeover, impacting confidentiality, integrity and availability. This is a remote code execution type vulnerability.

Affected Systems

The vulnerability affects Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as part of Oracle Fusion Middleware. Attackers may target the HTTP endpoints exposed by the Fabric Layer.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. Exploitability is possible over the network without authentication, but the attacker requires only low level privileges and a web client. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Given the high impact and the network attack vector, administrators should treat this as a high risk.

Generated by OpenCVE AI on October 21, 2026 at 08:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as published in the Oracle CPU Oct 2026 alert
  • Restrict HTTP access to the SOA Suite Fabric Layer with firewall rules or VPN to limit exposure
  • Monitor access logs for anomalous traffic to the Fabric Layer and review security configurations for unnecessary permissions

Generated by OpenCVE AI on October 21, 2026 at 08:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Fabric Layer Vulnerability Enables Remote Takeover of Oracle SOA Suite
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T18:09:18.623Z

Reserved: 2026-09-14T22:10:16.616Z

Link: CVE-2026-91226

cve-icon Vulnrichment

Updated: 2026-10-29T18:09:08.771Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:23.177

Modified: 2026-11-04T14:52:19.723

Link: CVE-2026-91226

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:30:09Z

Weaknesses