{"id":"CVE-2026-91225","kind":"vulnerability","aliases":["CVE-2026-91225"],"related":[],"title":"Oracle SOA Suite Adapters: unauthenticated HTTP flaw allows data changes and crashes","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","summary":"Oracle SOA Suite Adapters component: unauthenticated attacker over HTTP can create, modify or delete data and hang or crash the suite. CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N, I:H/A:H). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed in the October 2026 Critical Patch Update. No known exploitation.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"Find your SOA Suite version (12.2.1.4.0 or 14.1.2.0.0 means affected). Run 'opatch lsinventory' in the SOA Oracle_Home and check whether the October 2026 CPU SOA patch is applied. Oracle does not publish the vulnerable endpoint. Check whether SOA HTTP ports are reachable from untrusted networks.","fix":"Apply the Oct 2026 CPU patches for Oracle SOA Suite via My Oracle Support (Fusion Middleware patch availability document). The exact patch number is unknown without MOS login. If you cannot patch now, restrict network access to the SOA managed server HTTP ports.","status":"open","published_at":"2026-10-20T22:20:23+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:23+00:00","updated_at":"2026-10-23T23:01:52+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:23Z","model":"claude-haiku-5-5","output":{"fix":"Move to a patched Oracle SOA Suite release from Oracle's Critical Patch Update advisory for the affected versions 12.2.1.4.0 and 14.1.2.0.0; the sources do not name the fixed build.","reach":"internet","title":"Oracle SOA Suite Adapters: unauthenticated HTTP flaw allows data changes and crashes","impact":"medium","summary":"Oracle SOA Suite's Adapters component has a flaw that an unauthenticated attacker can reach over the network via HTTP. Successful exploitation lets the attacker create, modify or delete data the suite can access, and crash or hang the service.","category":"runtime","who_cares":["oracle-soa-suite","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker changes or deletes data and crashes the service","analyst_note":"Find the patched build and the exact Adapters endpoint or setting in Oracle's CPU advisory for CVE-2026-91225; the NVD page lists only the CVSS vector and affected versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000538,"input_tokens":3136,"output_tokens":448,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the patched build and the exact Adapters endpoint or setting in Oracle's CPU advisory for CVE-2026-91225; the NVD page lists only the CVSS vector and affected versions.","search":"'-2026':14A,17A '-91225':15A,18A '/av':174C '12.2.1.4.0':68B,101C '14.1.2.0.0':70B,103C '2026':75B '3.1':57B,162C,173C '9.1':58B,165C 'abil':146C 'access':112C,133C,142C 'adapt':4A,38B,94C 'affect':67B,99C 'allow':8A,107C 'attack':41B,109C,121C 'av':59B 'avail':168C 'base':163C 'caus':148C 'chang':10A 'complet':155C 'compon':39B,93C 'compromis':116C 'crash':12A,53B,154C 'creat':45B 'creation':129C 'critic':76B,135C 'cve':13A,16A 'cvss':56B,161C,170C,172C 'data':9A,49B,136C,143C 'delet':48B,130C 'dos':156C 'easili':104C 'exploit':81B,105C 'fix':71B 'flaw':7A 'frequent':152C 'fusion':25B,91C 'h':66B,182C 'h/a':65B,181C 'hang':51B,150C 'host':34B 'http':6A,43B,114C 'impact':169C 'integr':166C 'java':22B 'known':80B 'l/pr':61B,176C 'middlewar':26B,92C 'modif':132C 'modifi':46B 'n':63B 'n/ac':60B,175C 'n/i':180C 'n/s':178C 'n/ui':62B,177C 'network':111C 'octob':74B 'oracl':1A,24B,28B,35B,85C,90C,117C,139C,158C 'oracle':19A 'oracle-fusion-middlewar':23B 'oracle-soa-suit':27B 'patch':77B 'product':88C 'repeat':153C 'result':126C 'runtim':31B 'score':164C 'self':33B 'self-host':32B 'soa':2A,20A,29B,36B,86C,118C,140C,159C 'success':120C 'suit':3A,30B,37B,55B,87C,119C,141C,160C 'suite':21A 'support':95C 'u/c':179C 'unauthent':5A,40B,108C 'unauthor':128C,145C 'updat':78B 'vector':171C 'version':96C 'via':113C 'vulner':82C,106C,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91225","severity":null,"published_at":"2026-10-20T22:20:23+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91225:350","url":null,"severity":null,"published_at":"2026-10-23T23:01:52+00:00","modified_at":"2026-10-23T23:01:52+00:00","first_seen_at":"2026-10-23T23:01:52+00:00","fetched_at":"2026-10-23T23:01:52+00:00","note":"Oracle Oct 2026 CPU lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware; CVE.org text matches. The public advisory gives no patch number, endpoint or setting (patches sit behind My Oracle Support). Armis and Fortra report no exploitation. Fortra's CVE-2026-91231 is a separate SOA Adapters CVE (CVSS 10.0) with the same versions, so apply the whole CPU. No PoC or X search done."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1735,"url":"https://cve.armis.com/CVE-2026-91225","title":"CVE-2026-91225 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1736,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91225","title":"CVE Record: CVE-2026-91225","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}