Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote code execution / system takeover
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Oracle SOA Suite Fabric Layer allows a low‑privileged attacker with network access via multiple protocols to compromise the application. Successful exploitation can lead to full takeover of the Oracle SOA Suite, compromising confidentiality, integrity, and availability.

Affected Systems

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity, with network as the attack vector, low attack complexity, and low privilege required. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could remotely reach proprietary protocols exposed by the Fabric Layer, elevate privileges, and gain full control over the system. Because the vulnerability is described as easily exploitable, no special conditions are mentioned, suggesting broad risk to any exposed installation.

Generated by OpenCVE AI on October 21, 2026 at 08:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle SOA Suite to a version that contains the patch addressing the Fabric Layer privilege escalation vulnerability.
  • If immediate upgrade is not possible, strengthen network segmentation so that only trusted hosts can reach the SOA Suite components and disable unused protocols.
  • Review and tighten access control and authentication for Fabric Layer services to enforce proper privilege checks.

Generated by OpenCVE AI on October 21, 2026 at 08:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Fabric Layer Privilege Escalation Allowing Remote Takeover in Oracle SOA Suite
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:49.629Z

Reserved: 2026-09-14T22:10:16.617Z

Link: CVE-2026-91239

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:20:24.697

Modified: 2026-10-20T22:20:24.697

Link: CVE-2026-91239

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T08:30:15Z

Weaknesses