---
id: "CVE-2026-91225"
kind: "vulnerability"
aliases: ["CVE-2026-91225"]
title: "Oracle SOA Suite Adapters: unauthenticated HTTP flaw allows data changes and crashes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-20T22:20:23+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:01:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91225", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:01:52+00:00"}]
---

# Oracle SOA Suite Adapters: unauthenticated HTTP flaw allows data changes and crashes

Oracle SOA Suite Adapters component: unauthenticated attacker over HTTP can create, modify or delete data and hang or crash the suite. CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N, I:H/A:H). Affects 12.2.1.4.0 and 14.1.2.0.0. Fixed in the October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Find your SOA Suite version (12.2.1.4.0 or 14.1.2.0.0 means affected). Run 'opatch lsinventory' in the SOA Oracle_Home and check whether the October 2026 CPU SOA patch is applied. Oracle does not publish the vulnerable endpoint. Check whether SOA HTTP ports are reachable from untrusted networks.

## Fix

Apply the Oct 2026 CPU patches for Oracle SOA Suite via My Oracle Support (Fusion Middleware patch availability document). The exact patch number is unknown without MOS login. If you cannot patch now, restrict network access to the SOA managed server HTTP ports.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91225
- 2026-10-23T23:01:52+00:00 analyst — Oracle Oct 2026 CPU lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware; CVE.org text matches. The public advisory gives no patch number, endpoint or setting (patches sit behind My Oracle Support). Armis and Fortra report no exploitation. Fortra's CVE-2026-91231 is a separate SOA Adapters CVE (CVSS 10.0) with the same versions, so apply the whole CPU. No PoC or X search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91225 https://www.cve.org/CVERecord?id=CVE-2026-91225
- [mentions] CVE-2026-91225 | Armis https://cve.armis.com/CVE-2026-91225

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_