Oracle SOA Suite: unauthenticated network flaw allows full takeover

1. NVD2026-10-23 21:57 UTC · published 2026-10-20 22:20 UTC · CVE-2026-91236
2. InfraStack analyst2026-10-23 22:59 UTC · published 2026-10-23 22:59 UTC
   “Oracle CPU Oct 2026 (cpuoct2026.html) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as affected; CVSS 9.8, CWE-287/306 per OpenCVE (NVD awaiting analysis). Patch numbers are in the Fusion Middleware patch availability doc on My Oracle Support (login needed), not read. The verbose risk matrix was truncated before the FMW section, so the exact exploit path is unconfirmed. No exploitation or public PoC found; I did not search X or Bluesky. Sibling SOA Fabric Layer CVEs CVE-2026-91235 (9.8) and CVE-2026-91239 (8.8) were published the same day.”

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-91236 · 10-23 21:57
• Oracle Critical Patch Update Advisory - October 2026Advisory · InfraStack analyst
• OpenCVE: CVE-2026-91236 (CVSS 9.8, CWE-287/306)Describes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-91236")

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.