Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability resides in the Fabric Layer of Oracle SOA Suite. It permits an unauthenticated attacker who can reach the instance over HTTP to hijack the SOA Suite, effectively taking full control of the platform. The flaw is an access‑control bypass that grants remote code execution and compromises confidentiality, integrity, and availability.

Affected Systems

The affected products are Oracle SOA Suite, versions 12.2.1.4.0 and 14.1.2.0.0, which are part of Oracle Fusion Middleware.

Risk and Exploitability

The CVSS 3.1 score of 9.8 indicates critical severity. EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in any CISA KEV catalog. Attackers only need network access via HTTP; no prior authentication is required. The attack path is straightforward: a crafted request to the Fabric Layer endpoint yields unrestricted code execution on the host.

Generated by OpenCVE AI on October 22, 2026 at 01:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU October 2026 patch for SOA Suite 12.2.1.4.0 and 14.1.2.0.0.
  • Restrict inbound HTTP traffic to the SOA Suite Fabric Layer by configuring firewalls or a VPN so that only trusted networks can reach the service.
  • Monitor SOA Suite logs for abnormal Fabric Layer activity or unauthorized access attempts and investigate any suspicious events.

Generated by OpenCVE AI on October 22, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle SOA Suite Fabric Layer

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle SOA Suite Fabric Layer
Weaknesses CWE-284

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle SOA Suite Fabric Layer
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:17.746Z

Reserved: 2026-09-14T22:10:16.617Z

Link: CVE-2026-91236

cve-icon Vulnrichment

Updated: 2026-10-21T10:53:55.935Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:24.353

Modified: 2026-10-30T14:23:06.807

Link: CVE-2026-91236

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T01:30:07Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function