---
id: "CVE-2026-91234"
kind: "vulnerability"
aliases: ["CVE-2026-91234"]
title: "Oracle SOA Suite: unauthenticated network flaw allows full server takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["October 2026 CPU patch (number unknown)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "other-versions"]
published_at: "2026-10-20T22:20:24+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:00:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91234", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:00:44+00:00"}]
---

# Oracle SOA Suite: unauthenticated network flaw allows full server takeover

Oracle SOA Suite Fabric Layer flaw (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) lets an unauthenticated attacker over HTTP take over the SOA Suite instance. It affects 12.2.1.4.0 and 14.1.2.0.0 and was fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC has been reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number unknown)

## How to check

Find your SOA Suite version in the Oracle home with 'ORACLE_HOME/OPatch/opatch lsinventory', which lists Oracle SOA Suite and installed patches. If it is 12.2.1.4.0 or 14.1.2.0.0 and the October 2026 CPU patch is not listed, you are exposed. Also check whether the SOA Fabric Layer HTTP endpoints are reachable from untrusted networks.

## Fix

Apply the October 2026 Oracle CPU patch for SOA Suite (Fusion Middleware) with OPatch. Look up the patch numbers in the Fusion Middleware patch availability document on My Oracle Support (patch numbers unknown; I could not read that document). Interim step from Armis, not Oracle: restrict network access to the SOA Fabric Layer HTTP endpoint to trusted internal hosts. That does not stop internal attackers.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91234
- 2026-10-23T23:00:44+00:00 analyst — Oracle CPU Oct 2026 (published 2026-10-20) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc. Specific patch numbers are in a My Oracle Support patch availability document (login required) and I could not read them, so they are unknown. No exploitation or PoC reported; X count is 0. Workaround comes only from Armis, not Oracle. The Circuitry article says 27 SOA Suite flaws were fixed in the same CPU, so one CPU patch covers this CVE and its siblings.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0 https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1
- [mitigation] CVE-2026-91234 Armis https://cve.armis.com/CVE-2026-91234

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_