{"id":"CVE-2026-91233","kind":"vulnerability","aliases":["CVE-2026-91233"],"related":[],"title":"Oracle SOA Suite: unauthenticated SOAP flaw allows full takeover","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Enterprise Scheduling System component has an unauthenticated flaw reachable over SOAP (CVSS 3.1 9.8, CWE-269) that gives takeover of the SOA Suite server. It affects 12.2.1.4.0 and 14.1.2.0.0 and was fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC is known yet.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-scheduling","java","oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted","weblogic"],"not_affected_if":["no-enterprise-scheduling-service","no-network-exposure","not-deployed","other-soa-versions"],"how_to_check":"Find your SOA Suite version, for example with 'opatch lsinventory' in the Oracle home (look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0). Then check whether the Enterprise Scheduling Service SOAP endpoints on the WebLogic managed server can be reached from untrusted networks. Check whether the October 2026 CPU patch for SOA Suite is in the lsinventory output.","fix":"Apply the October 2026 Critical Patch Update for Oracle SOA Suite (Fusion Middleware patch availability document, My Oracle Support). The specific patch number was not readable without a login. Until patched, block untrusted network access to the scheduling service SOAP endpoints.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:20+00:00","updated_at":"2026-10-23T23:00:49+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for CVE-2026-91233 to your SOA Suite version; the patch id is unknown from these sources.\nUntil patched, restrict network access to the SOAP endpoints of the scheduling service.","reach":"internet","title":"Oracle SOA Suite: unauthenticated SOAP flaw allows full takeover","impact":"high","summary":"Oracle SOA Suite's Enterprise Scheduling System component has a flaw that a remote attacker can reach over SOAP without logging in. Successful exploitation gives the attacker takeover of the SOA Suite server.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java","enterprise-scheduling"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the SOA Suite server.","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the patched versions and whether the Enterprise Scheduling component is on by default.","how_to_check":"Confirm whether SOA Suite 12.2.1.4.0 or 14.1.2.0.0 is deployed and whether the Enterprise Scheduling Service is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["other-soa-versions","no-enterprise-scheduling-service"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000573,"input_tokens":3103,"output_tokens":526,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and patch list for CVE-2026-91233 to get the fixed version and the exact SOAP endpoint or component affected; check NVD link for further detail.","search":"'-2026':11A,14A '-269':55B '-91233':12A,15A '/av':155C '12.2.1.4.0':66B,109C '14.1.2.0.0':68B,111C '2026':76B '3.1':52B,142C,154C '9.8':53B,145C 'access':120C 'affect':65B,107C 'allow':7A,115C 'attack':117C,129C 'avail':149C 'base':143C 'compon':43B,99C 'compromis':124C 'confidenti':146C 'critic':77B 'cve':10A,13A 'cvss':51B,141C,151C,153C 'cwe':54B 'easili':112C 'enterpris':20B,40B,100C 'enterprise-schedul':19B 'exploit':81B,113C 'fix':71B 'flaw':6A,47B 'full':8A 'fusion':25B,97C 'give':57B 'h':163C 'h/a':162C 'h/i':161C 'host':34B 'impact':150C 'integr':147C 'java':22B 'known':86B 'l/pr':157C 'middlewar':26B,98C 'n/ac':156C 'n/s':159C 'n/ui':158C 'network':119C 'octob':75B 'oracl':1A,24B,28B,36B,73B,91C,96C,125C,138C 'oracle':16A 'oracle-fusion-middlewar':23B 'oracle-soa-suit':27B 'patch':78B 'poc':84B 'product':94C 'public':83B 'reachabl':48B 'result':134C 'runtim':31B 'schedul':21B,41B,101C 'score':144C 'self':33B 'self-host':32B 'server':63B 'soa':2A,17A,29B,37B,61B,92C,126C,139C 'soap':5A,50B,122C 'success':128C 'suit':3A,30B,38B,62B,93C,127C,140C 'suite':18A 'support':103C 'system':42B,102C 'takeov':9A,58B,136C 'u/c':160C 'unauthent':4A,46B,116C 'updat':79B 'vector':152C 'version':104C 'via':121C 'vulner':88C,114C,132C 'weblog':35B 'yet':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91233","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91233:347","url":null,"severity":null,"published_at":"2026-10-23T23:00:49+00:00","modified_at":"2026-10-23T23:00:49+00:00","first_seen_at":"2026-10-23T23:00:49+00:00","fetched_at":"2026-10-23T23:00:49+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0; CVE.org record confirms 9.8, unauth SOAP, Enterprise Scheduling System. Exact patch number is in the MOS Patch Availability Document (login required), not read. No exploitation or PoC found (Armis, VulDB, Rapid7: none; KEV false; no X posts). Sibling CVE-2026-60541 (July 2026, same component, via HTTP) is a different CVE."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1730,"url":"https://cve.armis.com/CVE-2026-91233","title":"CVE-2026-91233 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1731,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91233","title":"CVE Record: CVE-2026-91233","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}