{"id":"CVE-2026-91215","kind":"vulnerability","aliases":["CVE-2026-91215"],"related":[],"title":"Oracle SOA Suite: low-privilege HTTP request lets attackers take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives the attacker full takeover of the SOA Suite server, with high impact on confidentiality, integrity and availability.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","java","oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["not-installed","other-versions"],"how_to_check":"Find your SOA Suite version: run 'opatch lsinventory' in the SOA ORACLE_HOME and check the Oracle SOA Suite entry, or check the version in Fusion Middleware Control. 12.2.1.4.0 or 14.1.2.0.0 without the Oct 2026 CPU patch applied is exposed. Check that the CPU patch shows in the lsinventory output.","fix":"Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware (SOA Suite 12.2.1.4.0 and 14.1.2.0.0). The exact patch number is in the Fusion Middleware patch availability document on My Oracle Support (login required) and is not confirmed here. Interim, unconfirmed: restrict HTTP access to SOA Suite endpoints to trusted networks.","status":"open","published_at":"2026-10-20T22:20:21+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:28+00:00","updated_at":"2026-10-23T23:59:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle SOA Suite: low-privilege HTTP request lets attackers take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets a low-privileged user reach it over HTTP. A successful attack gives the attacker full takeover of the SOA Suite server, with high impact on confidentiality, integrity and availability.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the SOA Suite server and reads or changes its data","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patch version and any check steps; the NVD entry gives only the affected versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000504,"input_tokens":3088,"output_tokens":390,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patch version and any check steps; the NVD entry gives only the affected versions.","search":"'-2026':15A,18A '-91215':16A,19A '/av':150C '12.2.1.4.0':45B,103C '14.1.2.0.0':47B,105C '3.1':137C,149C '8.8':140C 'access':115C 'affect':101C 'allow':109C 'attack':10A,64B,67B,112C,124C 'avail':82B,144C 'base':138C 'compon':94C 'compromis':119C 'confidenti':79B,141C 'cve':14A,17A 'cvss':136C,146C,148C 'easili':106C 'exploit':107C 'fabric':41B,95C 'flaw':50B 'full':68B 'fusion':27B,92C 'give':65B 'h':158C 'h/a':157C 'h/i':156C 'high':76B 'host':36B 'http':7A,61B,117C 'impact':77B,145C 'infrastructur':23B 'integr':80B,142C 'java':24B 'l/pr':152C 'l/ui':153C 'layer':42B,96C 'let':9A,52B 'low':5A,55B,110C 'low-privileg':4A,54B 'middlewar':28B,93C 'n/ac':151C 'n/s':154C 'network':114C 'oracl':1A,26B,30B,37B,86C,91C,120C,133C 'oracle':20A 'oracle-fusion-middlewar':25B 'oracle-soa-suit':29B 'privileg':6A,56B,111C 'product':89C 'reach':58B 'request':8A 'result':129C 'runtim':33B 'score':139C 'self':35B 'self-host':34B 'server':13A,74B 'soa':2A,21A,31B,38B,72B,87C,121C,134C 'success':63B,123C 'suit':3A,32B,39B,73B,88C,122C,135C 'suite':22A 'support':97C 'take':11A 'takeov':69B,131C 'u/c':155C 'user':57B 'vector':147C 'version':44B,98C 'via':116C 'vulner':83C,108C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91215","severity":null,"published_at":"2026-10-20T22:20:21+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91215:561","url":null,"severity":null,"published_at":"2026-10-23T23:59:20+00:00","modified_at":"2026-10-23T23:59:20+00:00","first_seen_at":"2026-10-23T23:59:20+00:00","fetched_at":"2026-10-23T23:59:20+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware; the patch doc is a MOS note needing login, so the patch number is unknown. CVE record confirms CVSS 8.8 AV:N/PR:L. No exploitation or PoC found; did not search X or HN."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2291,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91215","title":"CVE Record: CVE-2026-91215","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}