{"id":"CVE-2026-91230","kind":"vulnerability","aliases":["CVE-2026-91230"],"related":[],"title":"Oracle SOA Suite: unauthenticated network flaw lets attackers access critical data","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","summary":"Oracle SOA Suite (Fusion Middleware) Fabric Layer flaw, fixed in Oracle's October 2026 Critical Patch Update. An unauthenticated attacker can reach it over HTTP. It can expose all data the suite can access and change some of it. CVSS 3.1 9.3, scope changed. Affects 12.2.1.4.0 and 14.1.2.0.0. No exploitation reported.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","on-prem","oracle-fusion-middleware","oracle-soa-suite","package","runtime","self-hosted"],"not_affected_if":["managed-hosting","not-internet-reachable","other-versions"],"how_to_check":"Check that the SOA Suite install is 12.2.1.4.0 or 14.1.2.0.0, for example with 'opatch lsinventory' in the Oracle home. Then check whether the October 2026 CPU SOA patch appears in the inventory. Patch numbers are in My Oracle Support (see Doc ID 551453.1 for how to find the CPU patches). Also check whether the SOA HTTP listener is reachable from untrusted networks.","fix":"Apply the Oracle SOA Suite patch from the October 2026 CPU through My Oracle Support (requires a support contract). The patch number is unknown, since the public advisory doesn't list it. Until you patch, limit access to the SOA HTTP endpoints to trusted networks or a VPN. That reduces exposure but does not fix the flaw.","status":"open","published_at":"2026-10-20T22:20:23+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:24+00:00","updated_at":"2026-10-23T23:01:58+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle SOA Suite: unauthenticated network flaw lets attackers access critical data","impact":"high","summary":"Oracle SOA Suite's Fabric Layer has a flaw that a remote attacker can reach over HTTP without logging in. Successful attacks can read all data the suite can access and alter or delete some of it.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads all SOA Suite data and alters some remotely","analyst_note":"Find Oracle's patch for SOA Suite 12.2.1.4.0 and 14.1.2.0.0 (Fabric Layer) and the check for it; start from https://nvd.nist.gov/vuln/detail/CVE-2026-91230.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000861,"input_tokens":3174,"output_tokens":1088,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's patch for SOA Suite 12.2.1.4.0 and 14.1.2.0.0 (Fabric Layer) and the check for it; start from https://nvd.nist.gov/vuln/detail/CVE-2026-91230.","search":"'-2026':13A,16A '-91230':14A,17A '/av':197C '12.2.1.4.0':83B,109C '14.1.2.0.0':85B,111C '2026':51B '3.1':78B,185C,196C '9.3':79B,188C 'access':9A,71B,120C,153C,159C,165C,175C,182C 'addit':140C 'affect':82B,107C 'allow':115C 'attack':8A,57B,117C,136C,145C 'base':186C 'c/c':202C 'chang':73B,81B,143C 'complet':158C 'compon':100C 'compromis':124C 'confidenti':189C 'critic':10A,52B,155C 'cve':12A,15A 'cvss':77B,184C,193C,195C 'data':11A,67B,156C,166C,183C 'delet':174C 'easili':112C 'exploit':87B,113C 'expos':65B 'fabric':43B,101C 'fix':46B 'flaw':6A,45B 'fusion':27B,41B,98C 'h/i':203C 'host':37B 'http':62B,122C 'impact':139C,192C 'insert':172C 'integr':191C 'java':21B 'l/a':204C 'l/pr':199C 'layer':44B,102C 'let':7A 'may':137C 'middlewar':28B,42B,99C 'n':205C 'n/ac':198C 'n/s':201C 'n/ui':200C 'network':5A,119C 'octob':50B 'on-prem':22B 'oracl':1A,26B,30B,38B,48B,92C,97C,125C,133C,162C,179C 'oracle':18A 'oracle-fusion-middlewar':25B 'oracle-soa-suit':29B 'packag':33B 'patch':53B 'prem':24B 'product':95C,141C 'reach':59B 'report':88B 'result':150C 'runtim':34B 'scope':80B,142C 'score':187C 'self':36B 'self-host':35B 'signific':138C 'soa':2A,19A,31B,39B,93C,126C,134C,163C,180C 'success':144C 'suit':3A,32B,40B,69B,94C,127C,135C,164C,181C 'suite':20A 'support':103C 'unauthent':4A,56B,116C 'unauthor':152C,170C 'updat':54B,171C 'vector':194C 'version':104C 'via':121C 'vulner':89C,114C,130C,148C 'well':168C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91230","severity":null,"published_at":"2026-10-20T22:20:23+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91230:349","url":null,"severity":null,"published_at":"2026-10-23T23:01:58+00:00","modified_at":"2026-10-23T23:01:58+00:00","first_seen_at":"2026-10-23T23:01:58+00:00","fetched_at":"2026-10-23T23:01:58+00:00","note":"Oracle CPU Oct 2026 (20 Oct) fixes it; CVE record confirms 12.2.1.4.0 and 14.1.2.0.0, CVSS 9.3. Patch numbers sit behind My Oracle Support (Doc ID 551453.1 is the CPU patch guide), so I could not read them. No exploitation or PoC found in the sources I read. I did not search X or HN."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1740,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91230","title":"CVE Record: CVE-2026-91230 (Oracle CNA text)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1738,"url":"https://cve.armis.com/CVE-2026-91230","title":"Armis: CVE-2026-91230","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}