{"id":"CVE-2026-91235","kind":"vulnerability","aliases":["CVE-2026-91235"],"related":[],"title":"Oracle SOA Suite Fabric Layer: unauthenticated network attacker can take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite (Fusion Middleware) Fabric Layer flaw lets an unauthenticated attacker with HTTP access take over the instance (CVSS 3.1 9.8, AV:N/AC:L/PR:N). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation reported as of 2026-10-23.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Find the SOA Suite version in the Oracle home with 'opatch lsinventory' or the WebLogic/SOA console. 12.2.1.4.0 and 14.1.2.0.0 are affected. Then check whether the October 2026 CPU patch for SOA Suite is listed in the lsinventory output. Also check whether the SOA HTTP listener (soa-infra) is reachable from untrusted networks.","fix":"Apply the Oracle October 2026 CPU patch for SOA Suite 12.2.1.4.0 or 14.1.2.0.0 with opatch, downloaded from My Oracle Support (needs a support contract). Oracle does not publish a fixed version string, so the patch number is unknown. Until patched, restrict network access to the SOA HTTP listener to trusted hosts at the firewall or load balancer.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:17+00:00","updated_at":"2026-10-23T23:00:44+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle SOA Suite Fabric Layer: unauthenticated network attacker can take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, part of Oracle Fusion Middleware, has a flaw reachable over HTTP without a login. Per the NVD description, a remote attacker can take over the SOA Suite instance, with full confidentiality, integrity and availability impact (CVSS 9.8).","category":"runtime","who_cares":["oracle-soa-suite","fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the SOA Suite server over HTTP","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE and the patched versions; check whether the HTTP endpoint is internet-facing by default at https://nvd.nist.gov/vuln/detail/CVE-2026-91235.","how_to_check":"Check the installed SOA Suite version against 12.2.1.4.0 and 14.1.2.0.0, which the NVD entry lists as affected.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000545,"input_tokens":3091,"output_tokens":472,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE and the patched versions; check whether the HTTP endpoint is internet-facing by default at https://nvd.nist.gov/vuln/detail/CVE-2026-91235.","search":"'-10':74B '-2026':14A,17A '-23':75B '-91235':15A,18A '/av':142C '12.2.1.4.0':96C '14.1.2.0.0':98C '2026':64B,73B '3.1':53B,129C,141C '9.8':54B,132C 'access':47B,107C 'affect':94C 'allow':102C 'attack':8A,44B,104C,116C 'av':55B 'avail':136C 'base':130C 'compon':87C 'compromis':111C 'confidenti':133C 'critic':65B 'cve':13A,16A 'cvss':52B,128C,138C,140C 'easili':99C 'exploit':69B,100C 'fabric':4A,38B,88C 'fix':59B 'flaw':40B 'fusion':23B,36B,85C 'fusion-middlewar':22B 'h':150C 'h/a':149C 'h/i':148C 'host':32B 'http':46B,109C 'impact':137C 'instanc':51B 'integr':134C 'l/pr':57B,144C 'layer':5A,39B,89C 'let':41B 'middlewar':24B,37B,86C 'n':58B 'n/ac':56B,143C 'n/s':146C 'n/ui':145C 'network':7A,106C 'octob':63B 'oracl':1A,26B,33B,61B,79C,84C,112C,125C 'oracle':19A 'oracle-soa-suit':25B 'patch':66B 'product':82C 'report':70B 'result':121C 'runtim':29B 'score':131C 'self':31B 'self-host':30B 'server':12A 'soa':2A,20A,27B,34B,80C,113C,126C 'success':115C 'suit':3A,28B,35B,81C,114C,127C 'suite':21A 'support':90C 'take':10A,48B 'takeov':123C 'u/c':147C 'unauthent':6A,43B,103C 'updat':67B 'vector':139C 'version':91C 'via':108C 'vulner':76C,101C,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91235","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91235:345","url":null,"severity":null,"published_at":"2026-10-23T23:00:44+00:00","modified_at":"2026-10-23T23:00:44+00:00","first_seen_at":"2026-10-23T23:00:44+00:00","fetched_at":"2026-10-23T23:00:44+00:00","note":"Oracle CPU Oct 2026 (rev 1, 20 Oct) lists it; affected 12.2.1.4.0 and 14.1.2.0.0 per CVE record. Oracle publishes no fixed version strings; patch is on My Oracle Support, so fix is by CPU patch number (unknown). No exploitation or PoC found in sources read; did not search social posts. Default internet exposure of the HTTP listener not verified; I did not read the NVD page, which returned empty."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1727,"url":"https://cve.armis.com/CVE-2026-91235","title":"CVE-2026-91235 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1728,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91235","title":"CVE Record: CVE-2026-91235","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}