Description
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote System Compromise
Action: Immediate Patch
AI Analysis

Impact

A low‑privileged attacker with network access can exploit a flaw in the Adapters component of Oracle SOA Suite and take complete control of the system, enabling full compromise of confidentiality, integrity and availability. The CVSS 3.1 score of 9.9 reflects the high impact and the fact that the flaw changes the overall scope of the affected system.

Affected Systems

Versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle SOA Suite within Oracle Fusion Middleware are affected. The vulnerability resides in the Adapters component and may also affect other integrated products when the scope changes.

Risk and Exploitability

The vulnerability is easily exploitable from the network using multiple protocols with low privileges required. Because the CVSS includes a scope change, an attacker could extend the impact beyond the SOA Suite itself, potentially compromising related services. The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, but the high CVSS plus network‑based attack vector make it a high‑risk item that should be treated with urgency.

Generated by OpenCVE AI on October 29, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch published in the October 2026 CPU advisory.
  • Restrict network access to SOA Suite endpoints, allowing connections only from trusted hosts or a hardened VPN.
  • Enforce strict role‑based access control and privilege management to mitigate improper access and privilege escalation (CWE‑269).
  • Monitor SOA Suite logs for anomalous adapter activity.

Generated by OpenCVE AI on October 29, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Oracle SOA Suite Adapters Vulnerability Allows Low‑Privileged Network Attacker to Compromise System

Wed, 28 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Oracle SOA Suite Adapters component remote takeover via low‑privileged network attacker
Weaknesses CWE-284

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Oracle SOA Suite Adapters component remote takeover via low‑privileged network attacker
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle soa Suite
CPEs cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle soa Suite
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Soa Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:31:53.540Z

Reserved: 2026-09-14T22:10:16.618Z

Link: CVE-2026-91250

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:25.970

Modified: 2026-10-28T21:17:17.423

Link: CVE-2026-91250

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T00:30:14Z

Weaknesses
  • CWE-269

    Improper Privilege Management