Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Data Compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Fabric Layer of Oracle SOA Suite, where an unauthenticated attacker who can reach the service over HTTP can compromise the system. Without needing valid credentials, the attacker can read sensitive data, modify or delete records. This results in severe confidentiality breach and integrity compromise, as reflected by the CVSS vector (Confidentiality high, Integrity low). The CVSS 3.1 score of 9.3 indicates a critical risk.

Affected Systems

Affected versions are Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. These releases belong to the Oracle Fusion Middleware family and are used in environments that host business process orchestration and integration services.

Risk and Exploitability

The exploitation requires only network connectivity to the SOA Suite HTTP ports and does not need user credentials. Because the vulnerability can affect additional products (scope change) and is not currently listed in the CISA KEV catalog, any machine connected to the network could be compromised if the SOA Suite instance is not patched or otherwise isolated. The EPSS score of <1% indicates a low probability of exploitation, but the high CVSS 9.3 score still signifies a serious risk in environments where HTTP is exposed to untrusted networks.

Generated by OpenCVE AI on October 30, 2026 at 16:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Critical Patch Update for October 2026 that addresses the Fabric Layer vulnerability in Oracle SOA Suite.
  • Restrict network access to the SOA Suite HTTP endpoints to trusted IP addresses or VPNs to eliminate direct exposure to attackers.
  • Configure firewall or security group rules to block or rate‑limit traffic to the Fabric Layer ports, and consider using a web application firewall to detect anomalous requests.
  • Enable detailed auditing and monitoring of SOA Suite logs to detect unauthorized data access or modification attempts.

Generated by OpenCVE AI on October 30, 2026 at 16:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle SOA Suite Fabric Layer

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Thu, 29 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle SOA Suite Fabric Layer
Weaknesses CWE-200
CWE-287

Thu, 29 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle SOA Suite Fabric Layer
Weaknesses CWE-200
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T18:03:03.382Z

Reserved: 2026-09-14T22:10:16.616Z

Link: CVE-2026-91230

cve-icon Vulnrichment

Updated: 2026-10-29T18:02:33.056Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:23.660

Modified: 2026-10-30T14:24:26.937

Link: CVE-2026-91230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T17:00:20Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function