{"id":"CVE-2026-91214","kind":"vulnerability","aliases":["CVE-2026-91214"],"related":[],"title":"Oracle SOA Suite Fabric Layer flaw lets unauthenticated network attackers take over","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 have a Fabric Layer flaw (CVSS 9.8, AV:N/AC:L/PR:N) that an unauthenticated attacker can reach over HTTP to take over the server. Oracle fixed it in the October 2026 Critical Patch Update, which fixes 27 SOA Suite flaws in all, including three rated 10.0. Weaknesses are improper access control and credential validation.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Check whether you run Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0. Run 'opatch lsinventory' in the Oracle home and look for the October 2026 SOA/Fusion Middleware CPU patch. If it is missing, you are exposed. Check whether SOA HTTP ports are reachable from untrusted networks.","fix":"Apply the Oracle October 2026 Critical Patch Update for SOA Suite (Fusion Middleware patch availability document on My Oracle Support). Until then, limit network access to SOA Suite HTTP endpoints. Oracle gives no workaround on the pages read.","status":"open","published_at":"2026-10-20T22:20:21+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:30+00:00","updated_at":"2026-10-23T23:03:00+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle SOA Suite Fabric Layer flaw lets unauthenticated network attackers take over","impact":"high","summary":"Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 have a flaw in the Fabric Layer that can be reached over HTTP. An unauthenticated attacker with network access can take over the Oracle SOA Suite server.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the SOA Suite server without credentials","analyst_note":"Find Oracle's July-style patch advisory or CPU entry for CVE-2026-91214 at https://nvd.nist.gov/vuln/detail/CVE-2026-91214 to get the patched versions and any workaround.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000509,"input_tokens":3095,"output_tokens":400,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's July-style patch advisory or CPU entry for CVE-2026-91214 at https://nvd.nist.gov/vuln/detail/CVE-2026-91214 to get the patched versions and any workaround.","search":"'-2026':13A,16A '-91214':14A,17A '/av':159C '10.0':84B '12.2.1.4.0':36B,113C '14.1.2.0.0':38B,115C '2026':69B '27':75B '3.1':146C,158C '9.8':45B,149C 'access':88B,124C 'affect':111C 'allow':119C 'attack':10A,53B,121C,133C 'av':46B 'avail':153C 'base':147C 'compon':104C 'compromis':128C 'confidenti':150C 'control':89B 'credenti':91B 'critic':70B 'cve':12A,15A 'cvss':44B,145C,155C,157C 'easili':116C 'exploit':117C 'fabric':4A,41B,105C 'fix':64B,74B 'flaw':6A,43B,78B 'fusion':23B,102C 'h':167C 'h/a':166C 'h/i':165C 'host':32B 'http':57B,126C 'impact':154C 'improp':87B 'includ':81B 'integr':151C 'l/pr':48B,161C 'layer':5A,42B,106C 'let':7A 'middlewar':24B,103C 'n':49B 'n/ac':47B,160C 'n/s':163C 'n/ui':162C 'network':9A,123C 'octob':68B 'oracl':1A,22B,26B,33B,63B,96C,101C,129C,142C 'oracle':18A 'oracle-fusion-middlewar':21B 'oracle-soa-suit':25B 'patch':71B 'product':99C 'rate':83B 'reach':55B 'result':138C 'runtim':29B 'score':148C 'self':31B 'self-host':30B 'server':62B 'soa':2A,19A,27B,34B,76B,97C,130C,143C 'success':132C 'suit':3A,28B,35B,77B,98C,131C,144C 'suite':20A 'support':107C 'take':11A,59B 'takeov':140C 'three':82B 'u/c':164C 'unauthent':8A,52B,120C 'updat':72B 'valid':92B 'vector':156C 'version':108C 'via':125C 'vulner':93C,118C,136C 'weak':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91214","severity":null,"published_at":"2026-10-20T22:20:21+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91214:356","url":null,"severity":null,"published_at":"2026-10-23T23:03:00+00:00","modified_at":"2026-10-23T23:03:00+00:00","first_seen_at":"2026-10-23T23:03:00+00:00","fetched_at":"2026-10-23T23:03:00+00:00","note":"Fixed in Oracle CPU October 2026 (cpuoct2026), 9.8 per CVE record. Exact patch numbers sit in a My Oracle Support patch availability document (login needed), so not read. No exploitation or PoC found (OpenCVE: KEV no, EPSS <1%). Did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1753,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91214","title":"CVE Record: CVE-2026-91214","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1712,"url":"https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1","title":"Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}