---
id: "CVE-2026-91233"
kind: "vulnerability"
aliases: ["CVE-2026-91233"]
title: "Oracle SOA Suite: unauthenticated SOAP flaw allows full takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-scheduling", "java", "oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted", "weblogic"]
not_affected_if: ["no-enterprise-scheduling-service", "no-network-exposure", "not-deployed", "other-soa-versions"]
published_at: "2026-10-20T22:20:24+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:00:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91233", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:00:49+00:00"}]
---

# Oracle SOA Suite: unauthenticated SOAP flaw allows full takeover

Oracle SOA Suite's Enterprise Scheduling System component has an unauthenticated flaw reachable over SOAP (CVSS 3.1 9.8, CWE-269) that gives takeover of the SOA Suite server. It affects 12.2.1.4.0 and 14.1.2.0.0 and was fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC is known yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Find your SOA Suite version, for example with 'opatch lsinventory' in the Oracle home (look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0). Then check whether the Enterprise Scheduling Service SOAP endpoints on the WebLogic managed server can be reached from untrusted networks. Check whether the October 2026 CPU patch for SOA Suite is in the lsinventory output.

## Fix

Apply the October 2026 Critical Patch Update for Oracle SOA Suite (Fusion Middleware patch availability document, My Oracle Support). The specific patch number was not readable without a login. Until patched, block untrusted network access to the scheduling service SOAP endpoints.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91233
- 2026-10-23T23:00:49+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0; CVE.org record confirms 9.8, unauth SOAP, Enterprise Scheduling System. Exact patch number is in the MOS Patch Availability Document (login required), not read. No exploitation or PoC found (Armis, VulDB, Rapid7: none; KEV false; no X posts). Sibling CVE-2026-60541 (July 2026, same component, via HTTP) is a different CVE.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE-2026-91233 | Armis https://cve.armis.com/CVE-2026-91233
- [describes] CVE Record: CVE-2026-91233 https://www.cve.org/CVERecord?id=CVE-2026-91233

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_