---
id: "CVE-2026-91221"
kind: "vulnerability"
aliases: ["CVE-2026-91221"]
title: "Oracle SOA Suite: unauthenticated network flaw allows full server takeover"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle SOA Suite", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["iiop", "java", "oracle-fusion-middleware", "oracle-soa-suite", "package", "self-hosted", "t3"]
not_affected_if: ["t3-iiop-not-reachable", "unknown"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:02:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91221", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:02:56+00:00"}]
---

# Oracle SOA Suite: unauthenticated network flaw allows full server takeover

Oracle SOA Suite's Fabric Layer, reachable over the T3 and IIOP protocols, has a flaw that lets an unauthenticated attacker on the network take over the server. The sources say the attack can also affect other products on the same deployment (scope change).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Find the SOA Suite version and patch level in the Oracle home: run $ORACLE_HOME/OPatch/opatch lsinventory and look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0, then compare with the October 2026 CPU patch list. Check T3/IIOP exposure: confirm the WebLogic listen ports (default 7001, or the SOA managed server port) are not reachable from untrusted networks.

## Fix

Apply the October 2026 Oracle CPU patch for SOA Suite (Fusion Middleware patch availability document on My Oracle Support); the specific patch number was not readable without login. Until patched, block T3/IIOP from untrusted networks, e.g. with a WebLogic connection filter. That filter is common WebLogic practice, not stated in the Oracle page I read.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91221
- 2026-10-23T23:02:56+00:00 analyst — Confirmed in Oracle CPU Oct 2026 (released 20 Oct) and CVE.org record: SOA Suite Fabric Layer, 12.2.1.4.0 and 14.1.2.0.0, CVSS 10.0 over T3/IIOP. The exact patch number is in the MOS Fusion Middleware patch availability document (login needed), which I did not read. No exploitation claimed by Oracle; no public PoC found. Did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91221 https://www.cve.org/CVERecord?id=CVE-2026-91221
- [mentions] Oracle October 2026 CPU: five CVSS 10.0 flaws to patch https://threatfrontier.com/articles/oracle-october-2026-cpu-soa-suite-access-manager-ebs-cvss-10

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_