Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Fabric Layer of Oracle SOA Suite allows an attacker with network access over HTTP to log in without authentication and compromise the application, potentially taking full control. The flaw delivers complete loss of confidentiality, integrity, and availability, as reflected by a CVSS 3.1 score of 9.8.

Affected Systems

The affected products are Oracle SOA Suite for Oracle Corporation. Specifically, versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable.

Risk and Exploitability

Because the vector is network‑based and requires no credentials, the risk of exploitation is very high. The EPSS score of 0.00486 indicates a very low probability of exploitation in the wild, but the high CVSS score and lack of remediation controls suggest the vulnerability remains a serious threat. The vulnerability is not listed in the CISA KEV catalog, but the exposure remains severe due to easy exploitation over HTTP.

Generated by OpenCVE AI on October 21, 2026 at 19:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Fusion Middleware patch for Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 released in the October 2026 CPU.
  • Restrict network access to the Fabric Layer by blocking or limiting inbound HTTP traffic from untrusted networks.
  • Configure firewall or segmentation rules to isolate the SOA Suite environment, ensuring that only authorized internal services can reach the Fabric Layer.

Generated by OpenCVE AI on October 21, 2026 at 19:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle SOA Suite Fabric Layer

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle SOA Suite Fabric Layer
Weaknesses CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:17.888Z

Reserved: 2026-09-14T22:10:16.617Z

Link: CVE-2026-91235

cve-icon Vulnrichment

Updated: 2026-10-21T10:54:03.126Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:24.243

Modified: 2026-10-30T14:23:39.813

Link: CVE-2026-91235

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:45:05Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function