---
id: "CVE-2026-91218"
kind: "vulnerability"
aliases: ["CVE-2026-91218"]
title: "Oracle SOA Suite: low-privilege HTTP request can alter or read all data"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (no version number)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fusion-middleware", "http", "oracle-soa-suite", "runtime", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:02:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91218", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:02:52+00:00"}]
---

# Oracle SOA Suite: low-privilege HTTP request can alter or read all data

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 have a flaw in the Fabric Layer. A low-privileged user with HTTP access can create, change or delete critical data and read all data the suite can access. The impact can reach other products (scope change). CVSS 9.6. Fixed by Oracle's October 2026 Critical Patch Update (published 2026-10-20).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (no version number)

## How to check

Find your SOA Suite version and patch level. On the host run: $ORACLE_HOME/OPatch/opatch lsinventory, and look for the SOA Suite 12.2.1.4.0 or 14.1.2.0.0 home. Then compare the installed patches with the October 2026 CPU Fusion Middleware patch availability document on My Oracle Support. If the October 2026 SOA patch is not listed, you are exposed. Exposure is highest if SOA HTTP endpoints are reachable by low-privileged or untrusted users.

## Fix

Apply the October 2026 CPU patch for Oracle SOA Suite (Fusion Middleware patch availability document, My Oracle Support). Oracle gives no new version number; the product stays on 12.2.1.4.0 or 14.1.2.0.0 with the patch applied. Until then, restrict HTTP access to SOA endpoints to trusted accounts and networks with a firewall or reverse proxy. This reduces the risk but does not remove the flaw.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91218
- 2026-10-23T23:02:52+00:00 analyst — Oracle CPU Oct 2026 lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as affected; Tenable/NVD mirror gives CVSS 9.6 (AV:N/PR:L/S:C, C:H/I:H), component Fabric Layer. No fixed version number: Oracle ships it as a CPU patch via the Fusion Middleware patch availability doc on My Oracle Support (login needed, not read). No exploitation or public PoC found in sources; no social search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Tenable: CVE-2026-91218 https://www.tenable.com/cve/CVE-2026-91218

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_