{"id":"CVE-2026-91227","kind":"vulnerability","aliases":["CVE-2026-91227"],"related":[],"title":"Oracle SOA Suite: Fabric Layer flaw lets low-privileged users take over","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer component has a flaw that lets an attacker with a low-privilege account reach it over HTTP. Successful exploitation can lead to full takeover of the SOA Suite, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","java","oracle","runtime","soa-suite"],"not_affected_if":["network-restricted","soa-not-deployed"],"how_to_check":"- Check the installed Oracle SOA Suite version against `12.2.1.4.0` and `14.1.2.0.0`, the affected releases named in the advisory.\n- Confirm whether the SOA Suite HTTP endpoints are reachable from untrusted networks.","fix":"- Apply the Oracle Critical Patch Update fix for Oracle SOA Suite (Fusion Middleware) that covers the Fabric Layer component; the specific patched version is unknown from these sources.","status":"open","published_at":"2026-10-20T22:20:23+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:18:42+00:00","updated_at":"2026-10-25T03:18:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:18:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle SOA Suite (Fusion Middleware) that covers the Fabric Layer component; the specific patched version is unknown from these sources.","reach":"internet","title":"Oracle SOA Suite: Fabric Layer flaw lets low-privileged users take over","impact":"high","summary":"Oracle SOA Suite's Fabric Layer component has a flaw that lets an attacker with a low-privilege account reach it over HTTP. Successful exploitation can lead to full takeover of the SOA Suite, with high impact to confidentiality, integrity and availability.","category":"runtime","nicknames":[],"who_cares":["oracle","soa-suite","fusion-middleware","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the Oracle SOA Suite server","analyst_note":"Confirm the patched version and any Oracle Critical Patch Update advisory for the Fabric Layer flaw; sources only give the NVD entry.","how_to_check":"- Check the installed Oracle SOA Suite version against `12.2.1.4.0` and `14.1.2.0.0`, the affected releases named in the advisory.\n- Confirm whether the SOA Suite HTTP endpoints are reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["soa-not-deployed","network-restricted"],"who_is_affected":"Teams running Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 with the HTTP interface reachable by low-privileged users. Deployments without SOA Suite, or with network access restricted, are less exposed. The attack is described as difficult to exploit.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3469,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91227':15A,18A '/av':139C '12.2.1.4.0':91C '14.1.2.0.0':93C '3.1':126C,138C '7.5':129C 'access':104C 'account':47B 'affect':89C 'allow':98C 'attack':41B,101C,113C 'avail':70B,133C 'base':127C 'compon':34B,82C 'compromis':108C 'confidenti':67B,130C 'cve':13A,16A 'cvss':125C,135C,137C 'difficult':94C 'exploit':53B,96C 'fabric':4A,32B,83C 'flaw':6A,37B 'full':57B 'fusion':20B,80C 'fusion-middlewar':19B 'h':147C 'h/a':146C 'h/i':145C 'h/pr':141C 'high':64B 'http':51B,106C 'impact':65B,134C 'integr':68B,131C 'java':22B 'l/ui':142C 'layer':5A,33B,84C 'lead':55B 'let':7A,39B 'low':9A,45B,99C 'low-privileg':8A,44B 'middlewar':21B,81C 'n/ac':140C 'n/s':143C 'network':103C 'oracl':1A,23B,28B,74C,79C,109C,122C 'privileg':10A,46B,100C 'product':77C 'reach':48B 'result':118C 'runtim':24B 'score':128C 'soa':2A,26B,29B,61B,75C,110C,123C 'soa-suit':25B 'success':52B,112C 'suit':3A,27B,30B,62B,76C,111C,124C 'support':85C 'take':12A 'takeov':58B,120C 'u/c':144C 'user':11A 'vector':136C 'version':86C 'via':105C 'vulner':71C,97C,116C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 with the HTTP interface reachable by low-privileged users. Deployments without SOA Suite, or with network access restricted, are less exposed. The attack is described as difficult to exploit.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91227","severity":null,"published_at":"2026-10-20T22:20:23+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}