---
id: "CVE-2026-91235"
kind: "vulnerability"
aliases: ["CVE-2026-91235"]
title: "Oracle SOA Suite Fabric Layer: unauthenticated network attacker can take over server"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:24+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T23:00:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91235", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:00:44+00:00"}]
---

# Oracle SOA Suite Fabric Layer: unauthenticated network attacker can take over server

Oracle SOA Suite (Fusion Middleware) Fabric Layer flaw lets an unauthenticated attacker with HTTP access take over the instance (CVSS 3.1 9.8, AV:N/AC:L/PR:N). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation reported as of 2026-10-23.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Find the SOA Suite version in the Oracle home with 'opatch lsinventory' or the WebLogic/SOA console. 12.2.1.4.0 and 14.1.2.0.0 are affected. Then check whether the October 2026 CPU patch for SOA Suite is listed in the lsinventory output. Also check whether the SOA HTTP listener (soa-infra) is reachable from untrusted networks.

## Fix

Apply the Oracle October 2026 CPU patch for SOA Suite 12.2.1.4.0 or 14.1.2.0.0 with opatch, downloaded from My Oracle Support (needs a support contract). Oracle does not publish a fixed version string, so the patch number is unknown. Until patched, restrict network access to the SOA HTTP listener to trusted hosts at the firewall or load balancer.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91235
- 2026-10-23T23:00:44+00:00 analyst — Oracle CPU Oct 2026 (rev 1, 20 Oct) lists it; affected 12.2.1.4.0 and 14.1.2.0.0 per CVE record. Oracle publishes no fixed version strings; patch is on My Oracle Support, so fix is by CPU patch number (unknown). No exploitation or PoC found in sources read; did not search social posts. Default internet exposure of the HTTP listener not verified; I did not read the NVD page, which returned empty.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91235 https://www.cve.org/CVERecord?id=CVE-2026-91235
- [mentions] CVE-2026-91235 | Armis https://cve.armis.com/CVE-2026-91235

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_