---
id: "CVE-2026-91217"
kind: "vulnerability"
aliases: ["CVE-2026-91217"]
title: "Oracle SOA Suite Fabric Layer flaw lets unauthenticated attackers read data"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "on-prem", "oracle-fusion-middleware", "oracle-soa-suite", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "not-internet-reachable", "other-versions", "unknown"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:58:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91217", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:58:27+00:00"}]
---

# Oracle SOA Suite Fabric Layer flaw lets unauthenticated attackers read data

Oracle SOA Suite (Fusion Middleware) Fabric Layer flaw, fixed in Oracle's October 2026 Critical Patch Update. An unauthenticated attacker can reach it over HTTP and read all data the SOA Suite instance can access, and may reach other connected products (scope change). CVSS 3.1 8.6. Affects 12.2.1.4.0 and 14.1.2.0.0. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Run 'opatch lsinventory' in the Oracle home to confirm the SOA Suite version is 12.2.1.4.0 or 14.1.2.0.0, and whether the October 2026 CPU SOA patch is listed. Patch numbers are in My Oracle Support (Doc ID 551453.1 is the CPU patch guide). Also check whether the SOA HTTP listener is reachable from untrusted networks.

## Fix

Apply the Oracle SOA Suite patch from the October 2026 CPU through My Oracle Support (needs a support contract). The patch number is unknown because the public advisory does not list it. Until patched, restrict access to the SOA HTTP endpoints to trusted networks or a VPN. That reduces exposure but does not fix the flaw.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91217
- 2026-10-23T23:58:27+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) fixes it; CVE record and Armis confirm 12.2.1.4.0 and 14.1.2.0.0, CVSS 8.6 (C:H, scope changed). Patch numbers are behind My Oracle Support so I could not read them. No exploitation or PoC found in the sources I read. I did not search X or HN. Same Fabric Layer family as CVE-2026-91230, which has a different CVSS (9.3).

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91217 (Oracle CNA text) https://www.cve.org/CVERecord?id=CVE-2026-91217
- [mitigation] Armis: CVE-2026-91217 https://cve.armis.com/CVE-2026-91217

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_