{"id":"CVE-2026-91232","kind":"vulnerability","aliases":["CVE-2026-91232"],"related":[],"title":"Oracle SOA Suite: low-privilege network flaw lets attackers take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over HTTP by a low-privilege user. A successful attacker can fully take over the suite and affect other products on the same deployment.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fusion-middleware","oracle-fusion-middleware","oracle-soa-suite","package","self-hosted","vendor"],"not_affected_if":["managed-hosting","other-versions"],"how_to_check":"Check whether Oracle SOA Suite (Fusion Middleware) 12.2.1.4.0 or 14.1.2.0.0 is installed: run OPatch lsinventory in the SOA Oracle home and see whether the October 2026 CPU SOA patch is listed. Check whether the SOA HTTP endpoints are reachable by any authenticated user.","fix":"Apply the Oracle October 2026 Critical Patch Update for Fusion Middleware / SOA Suite 12.2.1.4.0 and 14.1.2.0.0 (patch numbers in the MOS Fusion Middleware patch availability document; exact numbers unknown, not read). Interim: restrict HTTP access to SOA Suite to trusted internal networks and reduce low-privilege accounts; this does not remove the risk.","status":"open","published_at":"2026-10-20T22:20:23+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:20+00:00","updated_at":"2026-10-23T23:00:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle SOA Suite: low-privilege network flaw lets attackers take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over HTTP by a low-privilege user. A successful attacker can fully take over the suite and affect other products on the same deployment.","category":"package","who_cares":["oracle-soa-suite","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over SOA Suite and reaches connected products","analyst_note":"Check the Oracle Critical Patch Update advisory for the patch version and any workaround; sources here give no fix or detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000493,"input_tokens":3127,"output_tokens":361,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Oracle Critical Patch Update advisory for the patch version and any workaround; sources here give no fix or detection steps.","search":"'-2026':15A,18A '-91232':16A,19A '/av':162C '12.2.1.4.0':47B,99C '14.1.2.0.0':49B,101C '3.1':149C,161C '9.9':152C 'access':111C 'addit':131C 'affect':72B,97C 'allow':105C 'attack':10A,64B,108C,127C,136C 'avail':156C 'base':150C 'c/c':167C 'chang':134C 'compon':90C 'compromis':115C 'confidenti':153C 'cve':14A,17A 'cvss':148C,158C,160C 'deploy':78B 'easili':102C 'exploit':103C 'fabric':43B,91C 'flaw':8A,52B 'fulli':66B 'fusion':24B,28B,88C 'fusion-middlewar':23B 'h':170C 'h/a':169C 'h/i':168C 'host':37B 'http':55B,113C 'impact':130C,157C 'integr':154C 'l/pr':164C 'l/ui':165C 'layer':44B,92C 'let':9A 'low':5A,59B,106C 'low-privileg':4A,58B 'may':128C 'middlewar':25B,29B,89C 'n/ac':163C 'n/s':166C 'network':7A,110C 'oracl':1A,27B,31B,39B,82C,87C,116C,124C,145C 'oracle':20A 'oracle-fusion-middlewar':26B 'oracle-soa-suit':30B 'packag':34B 'privileg':6A,60B,107C 'product':74B,85C,132C 'reachabl':53B 'result':141C 'scope':133C 'score':151C 'self':36B 'self-host':35B 'server':13A 'signific':129C 'soa':2A,21A,32B,40B,83C,117C,125C,146C 'success':63B,135C 'suit':3A,33B,41B,70B,84C,118C,126C,147C 'suite':22A 'support':93C 'take':11A,67B 'takeov':143C 'user':61B 'vector':159C 'vendor':38B 'version':46B,94C 'via':112C 'vulner':79C,104C,121C,139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91232","severity":null,"published_at":"2026-10-20T22:20:23+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91232:348","url":null,"severity":null,"published_at":"2026-10-23T23:00:38+00:00","modified_at":"2026-10-23T23:00:38+00:00","first_seen_at":"2026-10-23T23:00:38+00:00","fetched_at":"2026-10-23T23:00:38+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026) is the fix source; patch numbers are behind My Oracle Support login, not read. No exploitation or PoC found; no social search done. Sibling SOA CVEs (91233-91236, 91250/1) are separate signals."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1722,"url":"https://cve.armis.com/CVE-2026-91232","title":"CVE-2026-91232 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}