{"id":"CVE-2026-91234","kind":"vulnerability","aliases":["CVE-2026-91234"],"related":[],"title":"Oracle SOA Suite: unauthenticated network flaw allows full server takeover","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite Fabric Layer flaw (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) lets an unauthenticated attacker over HTTP take over the SOA Suite instance. It affects 12.2.1.4.0 and 14.1.2.0.0 and was fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC has been reported.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU patch (number unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting","other-versions"],"how_to_check":"Find your SOA Suite version in the Oracle home with 'ORACLE_HOME/OPatch/opatch lsinventory', which lists Oracle SOA Suite and installed patches. If it is 12.2.1.4.0 or 14.1.2.0.0 and the October 2026 CPU patch is not listed, you are exposed. Also check whether the SOA Fabric Layer HTTP endpoints are reachable from untrusted networks.","fix":"Apply the October 2026 Oracle CPU patch for SOA Suite (Fusion Middleware) with OPatch. Look up the patch numbers in the Fusion Middleware patch availability document on My Oracle Support (patch numbers unknown; I could not read that document). Interim step from Armis, not Oracle: restrict network access to the SOA Fabric Layer HTTP endpoint to trusted internal hosts. That does not stop internal attackers.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:19+00:00","updated_at":"2026-10-23T23:00:44+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for CVE-2026-91234 for your SOA Suite version. The specific patch name is unknown from the sources.","reach":"internet","title":"Oracle SOA Suite: unauthenticated network flaw allows full server takeover","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw that lets an unauthenticated attacker over HTTP compromise the server. The sources say a successful attack can take over the Oracle SOA Suite instance (CVSS 9.8).","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the SOA Suite server over HTTP","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91234 and confirm the patch and the exposed HTTP endpoints; the NVD page lacks fix details.","how_to_check":"Check whether Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 is deployed, for example with the installed version in the SOA home or the Fusion Middleware inventory. unknown for any other check, as the sources do not say.","needs_analyst":true,"not_affected_if":["managed-hosting","other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000583,"input_tokens":3091,"output_tokens":548,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and patch numbers for SOA Suite 12.2.1.4.0 and 14.1.2.0.0, and confirm whether any workaround exists, since the sources give no fix or detection steps.","search":"'-2026':12A,15A '-91234':13A,16A '/av':149C '12.2.1.4.0':61B,103C '14.1.2.0.0':63B,105C '2026':71B '3.1':40B,136C,148C '9.8':41B,139C 'access':114C 'affect':60B,101C 'allow':7A,109C 'attack':50B,111C,123C 'av':42B 'avail':143C 'base':137C 'compon':94C 'compromis':118C 'confidenti':140C 'critic':72B 'cve':11A,14A 'cvss':39B,135C,145C,147C 'easili':106C 'exploit':76B,107C 'fabric':36B,95C 'fix':66B 'flaw':6A,38B 'full':8A 'fusion':23B,92C 'h':157C 'h/a':156C 'h/i':155C 'host':32B 'http':52B,116C 'impact':144C 'instanc':58B 'integr':141C 'java':20B 'l/pr':44B,151C 'layer':37B,96C 'let':47B 'middlewar':24B,93C 'n':46B 'n/ac':43B,150C 'n/s':153C 'n/ui':45B,152C 'network':5A,113C 'octob':70B 'oracl':1A,22B,26B,33B,68B,86C,91C,119C,132C 'oracle':17A 'oracle-fusion-middlewar':21B 'oracle-soa-suit':25B 'patch':73B 'poc':79B 'product':89C 'public':78B 'report':82B 'result':128C 'runtim':29B 'score':138C 'self':31B 'self-host':30B 'server':9A 'soa':2A,18A,27B,34B,56B,87C,120C,133C 'success':122C 'suit':3A,28B,35B,57B,88C,121C,134C 'suite':19A 'support':97C 'take':53B 'takeov':10A,130C 'u/c':154C 'unauthent':4A,49B,110C 'updat':74B 'vector':146C 'version':98C 'via':115C 'vulner':83C,108C,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91234","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91234:346","url":null,"severity":null,"published_at":"2026-10-23T23:00:44+00:00","modified_at":"2026-10-23T23:00:44+00:00","first_seen_at":"2026-10-23T23:00:44+00:00","fetched_at":"2026-10-23T23:00:44+00:00","note":"Oracle CPU Oct 2026 (published 2026-10-20) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc. Specific patch numbers are in a My Oracle Support patch availability document (login required) and I could not read them, so they are unknown. No exploitation or PoC reported; X count is 0. Workaround comes only from Armis, not Oracle. The Circuitry article says 27 SOA Suite flaws were fixed in the same CPU, so one CPU patch covers this CVE and its siblings."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1724,"url":"https://cve.armis.com/CVE-2026-91234","title":"CVE-2026-91234 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1712,"url":"https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1","title":"Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}