How do I check whether I am affected by CVE-2026-91224?

Check the SOA Suite version in your Oracle Fusion Middleware inventory (OPatch lsinventory in the SOA Oracle home). 12.2.1.4.0 or 14.1.2.0.0 without the Oct 2026 CPU SOA patch is exposed. List the installed patches with: $ORACLE_HOME/OPatch/opatch lsinventory

What is the fix for CVE-2026-91224?

Apply the Oracle SOA Suite patch from the October 2026 CPU through My Oracle Support, using the Fusion Middleware patch availability document linked from the advisory. Patch number: unknown (MOS login needed). Until patched, restrict HTTP access to SOA endpoints to trusted networks and minimize low-privilege accounts.

Who is not affected by CVE-2026-91224?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2026-91224

Go to dashboard

critical9.9Package

Oracle SOA Suite: low-privilege HTTP attacker can take over server

Oracle SOA Suite Fabric Layer flaw: a low-privileged attacker with HTTP access can take over SOA Suite (CVSS 9.9, scope change). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed by the October 2026 Critical Patch Update.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.9

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over SOA Suite and can affect other products.
CVSS said: 9.9. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91224

Go to dashboard

critical9.9Package

Oracle SOA Suite: low-privilege HTTP attacker can take over server

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.9

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker takes over SOA Suite and can affect other products.
CVSS said: 9.9. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle SOA Suite: low-privilege HTTP attacker can take over server

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle SOA Suite: low-privilege HTTP attacker can take over server

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources