{"id":"CVE-2026-91221","kind":"vulnerability","aliases":["CVE-2026-91221"],"related":[],"title":"Oracle SOA Suite: unauthenticated network flaw allows full server takeover","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer, reachable over the T3 and IIOP protocols, has a flaw that lets an unauthenticated attacker on the network take over the server. The sources say the attack can also affect other products on the same deployment (scope change).","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["iiop","java","oracle-fusion-middleware","oracle-soa-suite","package","self-hosted","t3"],"not_affected_if":["t3-iiop-not-reachable","unknown"],"how_to_check":"Find the SOA Suite version and patch level in the Oracle home: run $ORACLE_HOME/OPatch/opatch lsinventory and look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0, then compare with the October 2026 CPU patch list. Check T3/IIOP exposure: confirm the WebLogic listen ports (default 7001, or the SOA managed server port) are not reachable from untrusted networks.","fix":"Apply the October 2026 Oracle CPU patch for SOA Suite (Fusion Middleware patch availability document on My Oracle Support); the specific patch number was not readable without login. Until patched, block T3/IIOP from untrusted networks, e.g. with a WebLogic connection filter. That filter is common WebLogic practice, not stated in the Oracle page I read.","status":"open","published_at":"2026-10-20T22:20:22+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:25+00:00","updated_at":"2026-10-23T23:02:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:25Z","model":"claude-haiku-5-5","output":{"fix":"Move to a patched Oracle SOA Suite release from Oracle's security advisory; the sources do not name the fixed version. Affected versions per sources: 12.2.1.4.0 and 14.1.2.0.0.","reach":"network","title":"Oracle SOA Suite: unauthenticated network flaw allows full server takeover","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, reachable over the T3 and IIOP protocols, has a flaw that lets an unauthenticated attacker on the network take over the server. The sources say the attack can also affect other products on the same deployment (scope change).","category":"package","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the SOA server and can affect other products","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the fixed patch level and any T3/IIOP mitigation; the sources give no check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000531,"input_tokens":3130,"output_tokens":436,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the fixed patch level and any T3/IIOP mitigation; the sources give no check command.","search":"'-2026':12A,15A '-91221':13A,16A '/av':162C '10.0':152C '12.2.1.4.0':99C '14.1.2.0.0':101C '3.1':149C,161C 'access':110C 'addit':131C 'affect':70B,97C 'allow':7A,105C 'also':69B 'attack':55B,67B,107C,127C,136C 'avail':156C 'base':150C 'c/c':167C 'chang':78B,134C 'compon':90C 'compromis':115C 'confidenti':153C 'cve':11A,14A 'cvss':148C,158C,160C 'deploy':76B 'easili':102C 'exploit':103C 'fabric':39B,91C 'flaw':6A,50B 'full':8A 'fusion':24B,88C 'h':170C 'h/a':169C 'h/i':168C 'host':33B 'iiop':20B,46B,113C 'impact':130C,157C 'integr':154C 'java':21B 'l/pr':164C 'layer':40B,92C 'let':52B 'may':128C 'middlewar':25B,89C 'n/ac':163C 'n/s':166C 'n/ui':165C 'network':5A,58B,109C 'oracl':1A,23B,27B,35B,82C,87C,116C,124C,145C 'oracle':17A 'oracle-fusion-middlewar':22B 'oracle-soa-suit':26B 'packag':30B 'product':72B,85C,132C 'protocol':47B 'reachabl':41B 'result':141C 'say':65B 'scope':77B,133C 'score':151C 'self':32B 'self-host':31B 'server':9A,62B 'signific':129C 'soa':2A,18A,28B,36B,83C,117C,125C,146C 'sourc':64B 'success':135C 'suit':3A,29B,37B,84C,118C,126C,147C 'suite':19A 'support':93C 't3':34B,44B,112C 'take':59B 'takeov':10A,143C 'unauthent':4A,54B,106C 'vector':159C 'version':94C 'via':111C 'vulner':79C,104C,121C,139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91221","severity":null,"published_at":"2026-10-20T22:20:22+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91221:353","url":null,"severity":null,"published_at":"2026-10-23T23:02:56+00:00","modified_at":"2026-10-23T23:02:56+00:00","first_seen_at":"2026-10-23T23:02:56+00:00","fetched_at":"2026-10-23T23:02:56+00:00","note":"Confirmed in Oracle CPU Oct 2026 (released 20 Oct) and CVE.org record: SOA Suite Fabric Layer, 12.2.1.4.0 and 14.1.2.0.0, CVSS 10.0 over T3/IIOP. The exact patch number is in the MOS Fusion Middleware patch availability document (login needed), which I did not read. No exploitation claimed by Oracle; no public PoC found. Did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1748,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91221","title":"CVE Record: CVE-2026-91221","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1750,"url":"https://threatfrontier.com/articles/oracle-october-2026-cpu-soa-suite-access-manager-ebs-cvss-10","title":"Oracle October 2026 CPU: five CVSS 10.0 flaws to patch","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}