{"id":"CVE-2026-91224","kind":"vulnerability","aliases":["CVE-2026-91224"],"related":[],"title":"Oracle SOA Suite: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle SOA Suite Fabric Layer flaw: a low-privileged attacker with HTTP access can take over SOA Suite (CVSS 9.9, scope change). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed by the October 2026 Critical Patch Update.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["Oct 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-java","oracle-fusion-middleware","oracle-soa-suite","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the SOA Suite version in your Oracle Fusion Middleware inventory (OPatch lsinventory in the SOA Oracle home). 12.2.1.4.0 or 14.1.2.0.0 without the Oct 2026 CPU SOA patch is exposed. List the installed patches with: $ORACLE_HOME/OPatch/opatch lsinventory","fix":"Apply the Oracle SOA Suite patch from the October 2026 CPU through My Oracle Support, using the Fusion Middleware patch availability document linked from the advisory. Patch number: unknown (MOS login needed). Until patched, restrict HTTP access to SOA endpoints to trusted networks and minimize low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:22+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:22+00:00","updated_at":"2026-10-23T23:02:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:34:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle SOA Suite: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer component, versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets a low-privileged user reach it over the network via HTTP. Successful exploitation gives an attacker full takeover of the SOA Suite, with impact that can extend to other products.","category":"package","who_cares":["oracle-soa-suite","oracle-fusion-middleware","enterprise-java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over SOA Suite and can affect other products.","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number for CVE-2026-91224, and the exact fixed versions, via the NVD link and Oracle security alerts.","how_to_check":"Check whether Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 is deployed, for example via the Oracle Fusion Middleware installation inventory.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000545,"input_tokens":3130,"output_tokens":463,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number for CVE-2026-91224, and the exact fixed versions, via the NVD link and Oracle security alerts.","search":"'-2026':14A,17A '-91224':15A,18A '/av':155C '12.2.1.4.0':61B,92C '14.1.2.0.0':63B,94C '2026':68B '3.1':142C,154C '9.9':57B,145C 'access':50B,104C 'addit':124C 'affect':60B,90C 'allow':98C 'attack':8A,47B,101C,120C,129C 'avail':149C 'base':143C 'c/c':160C 'chang':59B,127C 'compon':83C 'compromis':108C 'confidenti':146C 'critic':69B 'cve':13A,16A 'cvss':56B,141C,151C,153C 'easili':95C 'enterpris':23B 'enterprise-java':22B 'exploit':96C 'fabric':40B,84C 'fix':64B 'flaw':42B 'fusion':27B,81C 'h':163C 'h/a':162C 'h/i':161C 'host':36B 'http':7A,49B,106C 'impact':123C,150C 'integr':147C 'java':24B 'l/pr':157C 'l/ui':158C 'layer':41B,85C 'low':5A,45B,99C 'low-privileg':4A,44B 'may':121C 'middlewar':28B,82C 'n/ac':156C 'n/s':159C 'network':103C 'octob':67B 'oracl':1A,26B,30B,37B,75C,80C,109C,117C,138C 'oracle':19A 'oracle-fusion-middlewar':25B 'oracle-soa-suit':29B 'packag':33B 'patch':70B 'privileg':6A,46B,100C 'product':78C,125C 'result':134C 'scope':58B,126C 'score':144C 'self':35B 'self-host':34B 'server':12A 'signific':122C 'soa':2A,20A,31B,38B,54B,76C,110C,118C,139C 'success':128C 'suit':3A,32B,39B,55B,77C,111C,119C,140C 'suite':21A 'support':86C 'take':10A,52B 'takeov':136C 'updat':71B 'vector':152C 'version':87C 'via':105C 'vulner':72C,97C,114C,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91224","severity":null,"published_at":"2026-10-20T22:20:22+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91224:351","url":null,"severity":null,"published_at":"2026-10-23T23:02:01+00:00","modified_at":"2026-10-23T23:02:01+00:00","first_seen_at":"2026-10-23T23:02:01+00:00","fetched_at":"2026-10-23T23:02:01+00:00","note":"Fixed in Oracle CPU October 2026 (20 Oct 2026, cpuoct2026.html); CVE.org record lists 12.2.1.4.0 and 14.1.2.0.0 affected, CVSS 9.9 (AV:N/PR:L/S:C). Patch number is not public: it sits in the My Oracle Support patch availability doc for Fusion Middleware, which I could not read. Patch 38835036 seen in search is the SOA container image, not this fix. No exploitation or PoC reported (Armis, Spirity: none in KEV). Sibling SOA Fabric Layer CVEs 91216 and 91221 are unauthenticated T3/IIOP at 10.0."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1742,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91224","title":"CVE Record: CVE-2026-91224","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1741,"url":"https://cve.armis.com/CVE-2026-91224","title":"CVE-2026-91224 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}