---
id: "CVE-2026-91223"
kind: "vulnerability"
aliases: ["CVE-2026-91223"]
title: "Oracle SOA Suite: low-privilege HTTP attacker can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "versions-other-than-12.2.1.4.0-and-14.1.2.0.0"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:58:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91223", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:58:30+00:00"}]
---

# Oracle SOA Suite: low-privilege HTTP attacker can take over server

Oracle SOA Suite's Fabric Layer component (12.2.1.4.0 and 14.1.2.0.0) has a flaw (CWE-269). A low-privileged authenticated attacker with HTTP network access can take over SOA Suite. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update, released 20 Oct 2026.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

You are exposed if you run Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 and have not applied the October 2026 CPU Fusion Middleware patch. On the Oracle home, run '$ORACLE_HOME/OPatch/opatch lspatches' and compare against the SOA Suite patch listed in the 'Fusion Middleware' Patch Availability Document (My Oracle Support login required). Check whether SOA endpoints (/soa-infra and others) are reachable over HTTP by users with any account.

## Fix

Apply the Oracle October 2026 CPU patch for Oracle SOA Suite (Fusion Middleware patch availability document, requires a support contract). The patch number is unknown because the MOS note was not accessible. Until patched, limit network access to SOA HTTP endpoints and review which accounts hold low-privilege logins. Oracle publishes no workaround.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91223
- 2026-10-23T23:58:30+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under the Fusion Middleware patch document. The exact patch number is behind My Oracle Support and was not readable. No exploitation or public PoC found (not in KEV; Rapid7 and VulDB show no activity). Did not search social posts; the CVE id has little coverage.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91223 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-91223

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_