{"id":"CVE-2026-91223","kind":"vulnerability","aliases":["CVE-2026-91223"],"related":[],"title":"Oracle SOA Suite: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer component (12.2.1.4.0 and 14.1.2.0.0) has a flaw (CWE-269). A low-privileged authenticated attacker with HTTP network access can take over SOA Suite. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update, released 20 Oct 2026.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting","versions-other-than-12.2.1.4.0-and-14.1.2.0.0"],"how_to_check":"You are exposed if you run Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 and have not applied the October 2026 CPU Fusion Middleware patch. On the Oracle home, run '$ORACLE_HOME/OPatch/opatch lspatches' and compare against the SOA Suite patch listed in the 'Fusion Middleware' Patch Availability Document (My Oracle Support login required). Check whether SOA endpoints (/soa-infra and others) are reachable over HTTP by users with any account.","fix":"Apply the Oracle October 2026 CPU patch for Oracle SOA Suite (Fusion Middleware patch availability document, requires a support contract). The patch number is unknown because the MOS note was not accessible. Until patched, limit network access to SOA HTTP endpoints and review which accounts hold low-privilege logins. Oracle publishes no workaround.","status":"open","published_at":"2026-10-20T22:20:22+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:24+00:00","updated_at":"2026-10-23T23:58:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle SOA Suite: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer component, versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets an attacker with a low-privilege account and network HTTP access take over the product. The sources say a successful attack gives full takeover, with confidentiality, integrity and availability all high (CVSS 8.8).","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over SOA Suite server, reading and changing all data","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE to get the patch version and any workaround; the NVD text gives no fix or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-other-than-12.2.1.4.0-and-14.1.2.0.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000517,"input_tokens":3086,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE to get the patch version and any workaround; the NVD text gives no fix or check steps.","search":"'-2026':14A,17A '-269':49B '-91223':15A,18A '/av':155C '12.2.1.4.0':42B,108C '14.1.2.0.0':44B,110C '20':85B '2026':80B,87B '3.1':66B,142C,154C '8.8':68B,145C 'access':59B,120C 'affect':106C 'allow':114C 'attack':8A,55B,117C,129C 'authent':54B 'av':69B 'avail':149C 'base':143C 'compon':41B,99C 'compromis':124C 'confidenti':146C 'critic':81B 'cve':13A,16A 'cvss':65B,141C,151C,153C 'cwe':48B 'easili':111C 'exploit':112C 'fabric':39B,100C 'fix':75B 'flaw':47B 'fusion':25B,97C 'h':163C 'h/a':162C 'h/i':161C 'host':34B 'http':7A,57B,122C 'impact':150C 'integr':147C 'java':22B 'l/pr':71B,157C 'l/ui':72B,158C 'layer':40B,101C 'low':5A,52B,115C 'low-privileg':4A,51B 'middlewar':26B,98C 'n':73B 'n/ac':70B,156C 'n/s':159C 'network':58B,119C 'oct':86B 'octob':79B 'oracl':1A,24B,28B,35B,74B,91C,96C,125C,138C 'oracle':19A 'oracle-fusion-middlewar':23B 'oracle-soa-suit':27B 'patch':82B 'privileg':6A,53B,116C 'product':94C 'releas':84B 'result':134C 'runtim':31B 'score':144C 'self':33B 'self-host':32B 'server':12A 'soa':2A,20A,29B,36B,63B,92C,126C,139C 'success':128C 'suit':3A,30B,37B,64B,93C,127C,140C 'suite':21A 'support':102C 'take':10A,61B 'takeov':136C 'u/c':160C 'updat':83B 'vector':152C 'version':103C 'via':121C 'vulner':88C,113C,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91223","severity":null,"published_at":"2026-10-20T22:20:22+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91223:559","url":null,"severity":null,"published_at":"2026-10-23T23:58:30+00:00","modified_at":"2026-10-23T23:58:30+00:00","first_seen_at":"2026-10-23T23:58:30+00:00","fetched_at":"2026-10-23T23:58:30+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under the Fusion Middleware patch document. The exact patch number is behind My Oracle Support and was not readable. No exploitation or public PoC found (not in KEV; Rapid7 and VulDB show no activity). Did not search social posts; the CVE id has little coverage."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2284,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91223","title":"CVE Record: CVE-2026-91223 (Oracle CNA)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}