{"id":"CVE-2026-91236","kind":"vulnerability","aliases":["CVE-2026-91236"],"related":[],"title":"Oracle SOA Suite: unauthenticated network flaw allows full takeover","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite's Fabric Layer lets an unauthenticated attacker with HTTP access take over the product (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; CWE-287 and CWE-306). Fixed in Oracle's October 2026 Critical Patch Update. Affects 12.2.1.4.0 and 14.1.2.0.0.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["unknown (Oct 2026 CPU patch)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-soa-suite","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Run OPatch from the SOA Oracle home: $ORACLE_HOME/OPatch/opatch lsinventory. Look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0, and for the October 2026 SOA patch. Compare against the patch listed in the Fusion Middleware patch availability document on My Oracle Support. Also check whether the SOA managed server (soa-infra) is reachable over HTTP from untrusted networks.","fix":"Apply the Oracle October 2026 CPU patch for SOA Suite (Fusion Middleware patch availability document on MOS; patch numbers unknown, not read). Until it is applied, block untrusted network access to the SOA managed server and soa-infra endpoints.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:16+00:00","updated_at":"2026-10-23T22:59:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T22:34:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a patched version or Oracle patch; check the Oracle Critical Patch Update advisory for CVE-2026-91236.","reach":"internet","title":"Oracle SOA Suite: unauthenticated network flaw allows full takeover","impact":"high","summary":"Oracle SOA Suite's Fabric Layer, in versions 12.2.1.4.0 and 14.1.2.0.0, can be attacked over HTTP without a login. A successful attacker can take over the product, with full confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over SOA Suite server remotely.","analyst_note":"Find the Oracle CPU advisory and patch numbers for 12.2.1.4.0 and 14.1.2.0.0 at https://nvd.nist.gov/vuln/detail/CVE-2026-91236; confirm the exact exploit path and check how to detect it.","how_to_check":"Run the installed SOA Suite version check (unknown for the exact command; check the Oracle Fusion Middleware home for 12.2.1.4.0 or 14.1.2.0.0).\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000571,"input_tokens":3095,"output_tokens":524,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory and patch numbers for 12.2.1.4.0 and 14.1.2.0.0 at https://nvd.nist.gov/vuln/detail/CVE-2026-91236; confirm the exact exploit path and check how to detect it.","search":"'-2026':11A,14A '-287':61B '-306':64B '-91236':12A,15A '/av':144C '12.2.1.4.0':75B,98C '14.1.2.0.0':77B,100C '2026':70B '3.1':49B,131C,143C '9.8':50B,134C 'access':43B,109C 'affect':74B,96C 'allow':7A,104C 'attack':40B,106C,118C 'av':51B 'avail':138C 'base':132C 'c':56B 'compon':89C 'compromis':113C 'confidenti':135C 'critic':71B 'cve':10A,13A 'cvss':48B,130C,140C,142C 'cwe':60B,63B 'easili':101C 'exploit':102C 'fabric':35B,90C 'fix':65B 'flaw':6A 'full':8A 'fusion':21B,87C 'h':59B,152C 'h/a':58B,151C 'h/i':57B,150C 'host':30B 'http':42B,111C 'impact':139C 'integr':136C 'l/pr':53B,146C 'layer':36B,91C 'let':37B 'middlewar':22B,88C 'n':55B 'n/ac':52B,145C 'n/s':148C 'n/ui':54B,147C 'network':5A,108C 'octob':69B 'oracl':1A,20B,24B,31B,67B,81C,86C,114C,127C 'oracle':16A 'oracle-fusion-middlewar':19B 'oracle-soa-suit':23B 'patch':72B 'product':47B,84C 'result':123C 'runtim':27B 'score':133C 'self':29B 'self-host':28B 'soa':2A,17A,25B,32B,82C,115C,128C 'success':117C 'suit':3A,26B,33B,83C,116C,129C 'suite':18A 'support':92C 'take':44B 'takeov':9A,125C 'u/c':149C 'unauthent':4A,39B,105C 'updat':73B 'vector':141C 'version':93C 'via':110C 'vulner':78C,103C,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91236","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91236:344","url":null,"severity":null,"published_at":"2026-10-23T22:59:52+00:00","modified_at":"2026-10-23T22:59:52+00:00","first_seen_at":"2026-10-23T22:59:52+00:00","fetched_at":"2026-10-23T22:59:52+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as affected; CVSS 9.8, CWE-287/306 per OpenCVE (NVD awaiting analysis). Patch numbers are in the Fusion Middleware patch availability doc on My Oracle Support (login needed), not read. The verbose risk matrix was truncated before the FMW section, so the exact exploit path is unconfirmed. No exploitation or public PoC found; I did not search X or Bluesky. Sibling SOA Fabric Layer CVEs CVE-2026-91235 (9.8) and CVE-2026-91239 (8.8) were published the same day."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1720,"url":"https://app.opencve.io/cve/CVE-2026-91236","title":"OpenCVE: CVE-2026-91236 (CVSS 9.8, CWE-287/306)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}