---
id: "CVE-2026-91214"
kind: "vulnerability"
aliases: ["CVE-2026-91214"]
title: "Oracle SOA Suite Fabric Layer flaw lets unauthenticated network attackers take over"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:21+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:03:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91214", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:03:00+00:00"}]
---

# Oracle SOA Suite Fabric Layer flaw lets unauthenticated network attackers take over

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 have a Fabric Layer flaw (CVSS 9.8, AV:N/AC:L/PR:N) that an unauthenticated attacker can reach over HTTP to take over the server. Oracle fixed it in the October 2026 Critical Patch Update, which fixes 27 SOA Suite flaws in all, including three rated 10.0. Weaknesses are improper access control and credential validation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch

## How to check

Check whether you run Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0. Run 'opatch lsinventory' in the Oracle home and look for the October 2026 SOA/Fusion Middleware CPU patch. If it is missing, you are exposed. Check whether SOA HTTP ports are reachable from untrusted networks.

## Fix

Apply the Oracle October 2026 Critical Patch Update for SOA Suite (Fusion Middleware patch availability document on My Oracle Support). Until then, limit network access to SOA Suite HTTP endpoints. Oracle gives no workaround on the pages read.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91214
- 2026-10-23T23:03:00+00:00 analyst — Fixed in Oracle CPU October 2026 (cpuoct2026), 9.8 per CVE record. Exact patch numbers sit in a My Oracle Support patch availability document (login needed), so not read. No exploitation or PoC found (OpenCVE: KEV no, EPSS <1%). Did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91214 https://www.cve.org/CVERecord?id=CVE-2026-91214
- [mentions] Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0 https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_