Oracle SOA Suite: unauthenticated network flaw allows full server takeover

1. NVD2026-10-23 21:57 UTC · published 2026-10-20 22:20 UTC · CVE-2026-91234
2. InfraStack analyst2026-10-23 23:00 UTC · published 2026-10-23 23:00 UTC
   “Oracle CPU Oct 2026 (published 2026-10-20) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc. Specific patch numbers are in a My Oracle Support patch availability document (login required) and I could not read them, so they are unknown. No exploitation or PoC reported; X count is 0. Workaround comes only from Armis, not Oracle. The Circuitry article says 27 SOA Suite flaws were fixed in the same CPU, so one CPU patch covers this CVE and its siblings.”

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-91234 · 10-23 21:57
• Oracle Critical Patch Update Advisory - October 2026Advisory · InfraStack analyst
• CVE-2026-91234 ArmisMitigation · InfraStack analyst
• Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0Mentions it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-91234")

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.