{"id":"CVE-2026-91239","kind":"vulnerability","aliases":["CVE-2026-91239"],"related":[],"title":"Oracle SOA Suite: low-privilege network attacker can take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle SOA Suite (Fabric Layer) 12.2.1.4.0 and 14.1.2.0.0: a low-privileged attacker with network access can take over SOA Suite (CVSS 3.1 8.8, AV:N/AC:L/PR:L). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation reported and no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":["October 2026 CPU (patch ID unknown)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fusion-middleware","java","on-prem","oracle-soa-suite","package","runtime","self-hosted"],"not_affected_if":["managed-hosting","other-versions"],"how_to_check":"Affected if you run Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0. Run '$ORACLE_HOME/OPatch/opatch lsinventory' on each SOA host to see the installed version and patches. Compare against the October 2026 CPU patch list for Fusion Middleware in My Oracle Support. This is standard Oracle practice and is not confirmed on the advisory page.","fix":"Apply the SOA Suite patch from the October 2026 CPU (Fusion Middleware Patch Availability Document in My Oracle Support, support contract needed). Patch ID: unknown; the MOS document would settle it. Until patched, restrict network access to SOA Suite and T3/IIOP endpoints to trusted hosts and review the low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:24+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:15+00:00","updated_at":"2026-10-23T23:58:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:15Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update for Fusion Middleware that covers SOA Suite 12.2.1.4.0 and 14.1.2.0.0; check the Oracle advisory for the exact patch.","reach":"network","title":"Oracle SOA Suite: low-privilege network attacker can take over server","impact":"high","summary":"Oracle SOA Suite's Fabric Layer component has a flaw that lets an attacker with a low-privilege account reach it over the network. A successful attack gives full takeover of the Oracle SOA Suite install, with high confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-soa-suite","fusion-middleware","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the SOA Suite server and reads or changes its data.","analyst_note":"Find the Oracle CPU advisory and patch ID for 12.2.1.4.0 and 14.1.2.0.0, and confirm how to check installed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":3082,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory and patch ID for 12.2.1.4.0 and 14.1.2.0.0, and confirm how to check installed version.","search":"'-2026':14A,17A '-91239':15A,18A '/av':151C '12.2.1.4.0':43B,103C '14.1.2.0.0':45B,105C '2026':71B '3.1':60B,138C,150C '8.8':61B,141C 'access':53B,115C 'affect':101C 'allow':109C 'attack':8A,50B,112C,125C 'av':62B 'avail':145C 'base':139C 'compon':94C 'compromis':120C 'confidenti':142C 'critic':72B 'cve':13A,16A 'cvss':59B,137C,147C,149C 'easili':106C 'exploit':76B,107C 'fabric':41B,95C 'fix':66B 'found':82B 'fusion':23B,92C 'fusion-middlewar':22B 'h':159C 'h/a':158C 'h/i':157C 'host':37B 'impact':146C 'integr':143C 'java':25B 'l':65B 'l/pr':64B,153C 'l/ui':154C 'layer':42B,96C 'low':5A,48B,110C 'low-privileg':4A,47B 'middlewar':24B,93C 'multipl':117C 'n/ac':63B,152C 'n/s':155C 'network':7A,52B,114C 'octob':70B 'on-prem':26B 'oracl':1A,30B,38B,68B,86C,91C,121C,134C 'oracle':19A 'oracle-soa-suit':29B 'packag':33B 'patch':73B 'poc':81B 'prem':28B 'privileg':6A,49B,111C 'product':89C 'protocol':118C 'public':80B 'report':77B 'result':130C 'runtim':34B 'score':140C 'self':36B 'self-host':35B 'server':12A 'soa':2A,20A,31B,39B,57B,87C,122C,135C 'success':124C 'suit':3A,32B,40B,58B,88C,123C,136C 'suite':21A 'support':97C 'take':10A,55B 'takeov':132C 'u/c':156C 'updat':74B 'vector':148C 'version':98C 'via':116C 'vulner':83C,108C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91239","severity":null,"published_at":"2026-10-20T22:20:24+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91239:558","url":null,"severity":null,"published_at":"2026-10-23T23:58:32+00:00","modified_at":"2026-10-23T23:58:32+00:00","first_seen_at":"2026-10-23T23:58:32+00:00","fetched_at":"2026-10-23T23:58:32+00:00","note":"Oracle Oct 2026 CPU (Rev 1, 20 Oct 2026) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under the Fusion Middleware patch availability document. The specific patch IDs are in My Oracle Support (login needed) and I could not read them, so I list none. No exploitation or public PoC found. Fortra and the CSO article describe separate SOA Suite CVEs rated 10.0 (e.g. CVE-2026-91231 in Adapters). Those are not this one, which is 8.8 and needs a low-privilege account."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2285,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91239","title":"CVE Record: CVE-2026-91239","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2281,"url":"https://www.fortra.com/blog/october-2026-oracle-critical-patch-update-analysis","title":"Fortra: October 2026 Oracle CPU analysis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}