---
id: "CVE-2026-91250"
kind: "vulnerability"
aliases: ["CVE-2026-91250"]
title: "Oracle SOA Suite Adapters: low-privilege network takeover of server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle SOA Suite", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-soa-suite", "package", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "other-versions-only"]
published_at: "2026-10-20T22:20:25+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:59:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91250", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:59:32+00:00"}]
---

# Oracle SOA Suite Adapters: low-privilege network takeover of server

Oracle SOA Suite (Fusion Middleware) Adapters component: an easily exploitable flaw lets a low-privileged attacker with network access over multiple protocols (Oracle does not name them in the NVD text) take over SOA Suite. Scope change means other products on the stack may be hit. CVSS 3.1 9.9. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Run OPatch lsinventory in the SOA Oracle Home (or check the WebLogic console) for the version. 12.2.1.4.0 and 14.1.2.0.0 are affected unless the October 2026 CPU Fusion Middleware SOA patch is in the inventory. Patch numbers are in the Fusion Middleware Patch Availability Doc on My Oracle Support.

## Fix

Apply the October 2026 CPU patch for Oracle SOA Suite from the Fusion Middleware Patch Availability Document (My Oracle Support, support contract required). The specific patch number is unknown. Interim: restrict network access to SOA Suite and adapter endpoints to trusted networks and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91250
- 2026-10-23T22:59:32+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) covers it; SOA Suite 12.2.1.4.0 and 14.1.2.0.0 affected. Patch numbers are in the Fusion Middleware Patch Availability Doc on My Oracle Support (login needed), so no fixed version read. Protocols: NVD text says only 'multiple protocols'; I did not see a per-protocol list (sibling CVE-2026-91251 says HTTP). Risk-matrix page was truncated before the Fusion Middleware section. No exploitation or PoC found; no social search done. Likely one of 27 SOA Suite CVEs in this CPU.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [mentions] Oracle patches 27 SOA Suite flaws, three rated CVSS 10.0 https://thecircuitry.to/article/oracle-patches-27-soa-suite-flaws-three-rated-cvss-10-mvi10jo1

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_