Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Data compromise via unauthorized HTTP access
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in the Fabric Layer of Oracle SOA Suite allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The flaw enables compromise of all accessible data within the suite and results in a high confidentiality impact, as defined by a CVSS 3.1 Base Score of 7.5.

Affected Systems

The affected products are Oracle SOA Suite version 12.2.1.4.0 and version 14.1.2.0.0, as distributed by Oracle Corporation.

Risk and Exploitability

The CVSS score indicates a high severity vulnerability, and the lack of an exploit probability score means the risk is primarily driven by the high confidence that the flaw can be exploited by any actor with network connectivity. The vulnerability is included in an official Oracle update, but it is not listed in the CISA KEV catalog. The most likely attack vector is a simple, unauthenticated HTTP request to the affected system.

Generated by OpenCVE AI on October 21, 2026 at 08:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade Oracle SOA Suite to a version that removes the unauthenticated HTTP access flaw
  • If a patch is not yet available, implement network-level controls (e.g., firewall rules or VPN) to restrict HTTP access to the SOA Suite to trusted hosts only
  • Monitor application logs for unusual request patterns that may indicate attempts to exploit the unauthenticated access flaw

Generated by OpenCVE AI on October 21, 2026 at 08:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Data Compromise in Oracle SOA Suite
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:48.950Z

Reserved: 2026-09-14T22:10:16.617Z

Link: CVE-2026-91237

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:20:24.477

Modified: 2026-10-20T22:20:24.477

Link: CVE-2026-91237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T08:30:15Z

Weaknesses