---
id: "CVE-2026-91224"
kind: "vulnerability"
aliases: ["CVE-2026-91224"]
title: "Oracle SOA Suite: low-privilege HTTP attacker can take over server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle SOA Suite", "fixed": ["Oct 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-java", "oracle-fusion-middleware", "oracle-soa-suite", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:22+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:02:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91224", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:02:01+00:00"}]
---

# Oracle SOA Suite: low-privilege HTTP attacker can take over server

Oracle SOA Suite Fabric Layer flaw: a low-privileged attacker with HTTP access can take over SOA Suite (CVSS 9.9, scope change). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed by the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed Oct 2026 CPU patch (number unknown)

## How to check

Check the SOA Suite version in your Oracle Fusion Middleware inventory (OPatch lsinventory in the SOA Oracle home). 12.2.1.4.0 or 14.1.2.0.0 without the Oct 2026 CPU SOA patch is exposed. List the installed patches with: $ORACLE_HOME/OPatch/opatch lsinventory

## Fix

Apply the Oracle SOA Suite patch from the October 2026 CPU through My Oracle Support, using the Fusion Middleware patch availability document linked from the advisory. Patch number: unknown (MOS login needed). Until patched, restrict HTTP access to SOA endpoints to trusted networks and minimize low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91224
- 2026-10-23T23:02:01+00:00 analyst — Fixed in Oracle CPU October 2026 (20 Oct 2026, cpuoct2026.html); CVE.org record lists 12.2.1.4.0 and 14.1.2.0.0 affected, CVSS 9.9 (AV:N/PR:L/S:C). Patch number is not public: it sits in the My Oracle Support patch availability doc for Fusion Middleware, which I could not read. Patch 38835036 seen in search is the SOA container image, not this fix. No exploitation or PoC reported (Armis, Spirity: none in KEV). Sibling SOA Fabric Layer CVEs 91216 and 91221 are unauthenticated T3/IIOP at 10.0.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91224 https://www.cve.org/CVERecord?id=CVE-2026-91224
- [mentions] CVE-2026-91224 | Armis https://cve.armis.com/CVE-2026-91224

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_