Live › vulnerability › CVE-2026-91225
Go to dashboardOracle SOA Suite Adapters component: unauthenticated attacker over HTTP can create, modify or delete data and hang or crash the suite. CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N, I:H/A:H). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed in the October 2026 Critical Patch Update. No known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle SOA Suite | vendor | 12.2.1.4.0, 14.1.2.0.0 | October 2026 CPU patch (number unknown) |
12.2.1.4.0 or 14.1.2.0.0 means affected)opatch lsinventory in the SOA Oracle_Home and check whether the October 2026 CPU SOA patch is appliedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91225")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.