Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Fabric Layer of Oracle SOA Suite allows a low‑privileged attacker with network access through HTTP to compromise the system. Successful exploitation can lead to takeover, with full confidentiality, integrity, and availability impact. The weakness involves insufficient authorization checks, permitting unauthorized access and control.

Affected Systems

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

Risk and Exploitability

The CVSS base score is 9.9, indicating critical severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The attack vector is via network over HTTP, requiring only low privileges, with no user interaction needed.

Generated by OpenCVE AI on October 21, 2026 at 08:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch that resolves CVE-2026-91232 for all affected instances of Oracle SOA Suite.
  • Limit HTTP access to the SOA Suite environment to trusted IP ranges or enforce VPN connectivity to block untrusted traffic.
  • Enable comprehensive logging and create alerts for anomalous requests to Fabric Layer endpoints to aid early detection.

Generated by OpenCVE AI on October 21, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title High‑Impact Remote Code Execution via Fabric Layer in Oracle SOA Suite
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T18:00:46.512Z

Reserved: 2026-09-14T22:10:16.617Z

Link: CVE-2026-91232

cve-icon Vulnrichment

Updated: 2026-10-29T18:00:40.586Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:23.897

Modified: 2026-11-04T14:52:37.693

Link: CVE-2026-91232

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:30:09Z

Weaknesses