{"id":"CVE-2026-91250","kind":"vulnerability","aliases":["CVE-2026-91250"],"related":[],"title":"Oracle SOA Suite Adapters: low-privilege network takeover of server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle SOA Suite (Fusion Middleware) Adapters component: an easily exploitable flaw lets a low-privileged attacker with network access over multiple protocols (Oracle does not name them in the NVD text) take over SOA Suite. Scope change means other products on the stack may be hit. CVSS 3.1 9.9. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-soa-suite","package","self-hosted","vendor"],"not_affected_if":["managed-hosting","other-versions-only"],"how_to_check":"Run OPatch lsinventory in the SOA Oracle Home (or check the WebLogic console) for the version. 12.2.1.4.0 and 14.1.2.0.0 are affected unless the October 2026 CPU Fusion Middleware SOA patch is in the inventory. Patch numbers are in the Fusion Middleware Patch Availability Doc on My Oracle Support.","fix":"Apply the October 2026 CPU patch for Oracle SOA Suite from the Fusion Middleware Patch Availability Document (My Oracle Support, support contract required). The specific patch number is unknown. Interim: restrict network access to SOA Suite and adapter endpoints to trusted networks and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:25+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:13+00:00","updated_at":"2026-10-23T22:59:32+00:00","category":"vendor","confidence":0.65,"triage":{"at":"2026-10-23T22:34:13Z","model":"claude-haiku-5-5","output":{"fix":"Move Oracle SOA Suite to a patched release per Oracle's Critical Patch Update; the sources do not name the fixed version. Affected versions listed: 12.2.1.4.0 and 14.1.2.0.0.","reach":"network","title":"Oracle SOA Suite Adapters: low-privilege network takeover of server","impact":"high","summary":"Oracle SOA Suite's Adapters component has a flaw that lets a low-privileged user on the network take over the server. The source says the attack can also reach other products on the same stack because of scope change.","category":"vendor","who_cares":["oracle-soa-suite","oracle-fusion-middleware","java"],"confidence":0.8,"needs_auth":"yes","worst_case":"attacker takes over SOA Suite and can affect other products","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched version numbers for 12.2.1.4.0 and 14.1.2.0.0, and confirm which Adapters protocols are involved.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions-only"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":3119,"output_tokens":423,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched version numbers for 12.2.1.4.0 and 14.1.2.0.0, and confirm which Adapters protocols are involved.","search":"'-2026':13A,16A '-91250':14A,17A '/av':180C '12.2.1.4.0':116C '14.1.2.0.0':118C '2026':90B '3.1':83B,167C,179C '9.9':84B,170C 'access':54B,128C 'adapt':4A,40B,109C 'addit':149C 'affect':114C 'allow':122C 'attack':51B,125C,145C,154C 'avail':174C 'base':168C 'c/c':185C 'chang':72B,152C 'compon':41B,108C 'compromis':133C 'confidenti':171C 'critic':91B 'cve':12A,15A 'cvss':82B,166C,176C,178C 'easili':43B,119C 'exploit':44B,96B,120C 'fix':85B 'flaw':45B 'fusion':24B,38B,106C 'h':188C 'h/a':187C 'h/i':186C 'hit':81B 'host':33B 'impact':148C,175C 'integr':172C 'java':21B 'known':95B 'l/pr':182C 'l/ui':183C 'let':46B 'low':6A,49B,123C 'low-privileg':5A,48B 'may':79B,146C 'mean':73B 'middlewar':25B,39B,107C 'multipl':56B,130C 'n/ac':181C 'n/s':184C 'name':61B 'network':8A,53B,127C 'nvd':65B 'octob':89B 'oracl':1A,23B,27B,35B,58B,87B,100C,105C,134C,142C,163C 'oracle':18A 'oracle-fusion-middlewar':22B 'oracle-soa-suit':26B 'packag':30B 'patch':92B 'privileg':7A,50B,124C 'product':75B,103C,150C 'protocol':57B,131C 'result':159C 'scope':71B,151C 'score':169C 'self':32B 'self-host':31B 'server':11A 'signific':147C 'soa':2A,19A,28B,36B,69B,101C,135C,143C,164C 'stack':78B 'success':153C 'suit':3A,29B,37B,70B,102C,136C,144C,165C 'suite':20A 'support':110C 'take':67B 'takeov':9A,161C 'text':66B 'updat':93B 'vector':177C 'vendor':34B 'version':111C 'via':129C 'vulner':97C,121C,139C,157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91250","severity":null,"published_at":"2026-10-20T22:20:25+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91250:341","url":null,"severity":null,"published_at":"2026-10-23T22:59:32+00:00","modified_at":"2026-10-23T22:59:32+00:00","first_seen_at":"2026-10-23T22:59:32+00:00","fetched_at":"2026-10-23T22:59:32+00:00","note":"Oracle CPU Oct 2026 (20 Oct) covers it; SOA Suite 12.2.1.4.0 and 14.1.2.0.0 affected. Patch numbers are in the Fusion Middleware Patch Availability Doc on My Oracle Support (login needed), so no fixed version read. Protocols: NVD text says only 'multiple protocols'; I did not see a per-protocol list (sibling CVE-2026-91251 says HTTP). Risk-matrix page was truncated before the Fusion Middleware section. No exploitation or PoC found; no social search done. Likely one of 27 SOA Suite CVEs in this CPU."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1712,"url":"https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1","title":"Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}