---
id: "CVE-2026-91236"
kind: "vulnerability"
aliases: ["CVE-2026-91236"]
title: "Oracle SOA Suite: unauthenticated network flaw allows full takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": ["unknown (Oct 2026 CPU patch)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-soa-suite", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:24+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:59:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91236", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:59:52+00:00"}]
---

# Oracle SOA Suite: unauthenticated network flaw allows full takeover

Oracle SOA Suite's Fabric Layer lets an unauthenticated attacker with HTTP access take over the product (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; CWE-287 and CWE-306). Fixed in Oracle's October 2026 Critical Patch Update. Affects 12.2.1.4.0 and 14.1.2.0.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed unknown (Oct 2026 CPU patch)

## How to check

Run OPatch from the SOA Oracle home: $ORACLE_HOME/OPatch/opatch lsinventory. Look for Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0, and for the October 2026 SOA patch. Compare against the patch listed in the Fusion Middleware patch availability document on My Oracle Support. Also check whether the SOA managed server (soa-infra) is reachable over HTTP from untrusted networks.

## Fix

Apply the Oracle October 2026 CPU patch for SOA Suite (Fusion Middleware patch availability document on MOS; patch numbers unknown, not read). Until it is applied, block untrusted network access to the SOA managed server and soa-infra endpoints.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91236
- 2026-10-23T22:59:52+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 as affected; CVSS 9.8, CWE-287/306 per OpenCVE (NVD awaiting analysis). Patch numbers are in the Fusion Middleware patch availability doc on My Oracle Support (login needed), not read. The verbose risk matrix was truncated before the FMW section, so the exact exploit path is unconfirmed. No exploitation or public PoC found; I did not search X or Bluesky. Sibling SOA Fabric Layer CVEs CVE-2026-91235 (9.8) and CVE-2026-91239 (8.8) were published the same day.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] OpenCVE: CVE-2026-91236 (CVSS 9.8, CWE-287/306) https://app.opencve.io/cve/CVE-2026-91236

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_