{"id":"CVE-2026-91251","kind":"vulnerability","aliases":["CVE-2026-91251"],"related":[],"title":"Oracle SOA Suite Adapters flaw lets low-privilege users take over server","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","summary":"Oracle SOA Suite (Fusion Middleware) Adapters component: an easily exploitable flaw lets a low-privileged attacker with HTTP network access take over SOA Suite, with scope change that can affect other products. CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle SOA Suite","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-soa-suite","other","runtime","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Check your SOA Suite version (OPatch lsinventory in the SOA Oracle Home, or the WebLogic console). Versions 12.2.1.4.0 and 14.1.2.0.0 are affected unless the October 2026 CPU Fusion Middleware patch is in the inventory. Patch numbers are in the Fusion Middleware patch availability doc on My Oracle Support.","fix":"Apply the Oct 2026 CPU patch for Oracle SOA Suite from the Fusion Middleware Patch Availability Document (My Oracle Support, needs a support contract). Specific patch number unknown. Workaround: limit HTTP access to SOA Suite and adapter endpoints to trusted networks and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:12+00:00","updated_at":"2026-10-23T22:58:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle SOA Suite Adapters flaw lets low-privilege users take over server","impact":"high","summary":"Oracle SOA Suite's Adapters component has a flaw reachable over HTTP. A low-privilege attacker with network access can fully take over the suite and affect other products on the same system.","category":"runtime","who_cares":["oracle-soa-suite","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over SOA Suite and reaches other products","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get patched versions and the affected-component check; the sources only list 12.2.1.4.0 and 14.1.2.0.0.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":3123,"output_tokens":351,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get patched versions and the affected-component check; the sources only list 12.2.1.4.0 and 14.1.2.0.0.","search":"'-2026':15A,18A '-91251':16A,19A '/av':175C '12.2.1.4.0':112C '14.1.2.0.0':114C '2026':86B '3.1':70B,162C,174C '9.9':71B,165C 'access':56B,124C 'adapt':4A,41B,105C 'addit':144C 'affect':66B,110C 'allow':118C 'attack':52B,121C,140C,149C 'av':72B 'avail':169C 'base':163C 'c/c':77B,180C 'chang':63B,147C 'compon':42B,104C 'compromis':128C 'confidenti':166C 'critic':87B 'cve':14A,17A 'cvss':69B,161C,171C,173C 'easili':44B,115C 'exploit':45B,92B,116C 'fix':81B 'flaw':5A,46B 'fusion':25B,39B,102C 'h':80B,183C 'h/a':79B,182C 'h/i':78B,181C 'host':35B 'http':54B,126C 'impact':143C,170C 'integr':167C 'known':91B 'l/pr':74B,177C 'l/ui':75B,178C 'let':6A,47B 'low':8A,50B,119C 'low-privileg':7A,49B 'may':141C 'middlewar':26B,40B,103C 'n/ac':73B,176C 'n/s':76B,179C 'network':55B,123C 'octob':85B 'oracl':1A,24B,28B,36B,83B,96C,101C,129C,137C,158C 'oracle':20A 'oracle-fusion-middlewar':23B 'oracle-soa-suit':27B 'patch':88B 'privileg':9A,51B,120C 'product':68B,99C,145C 'result':154C 'runtim':32B 'scope':62B,146C 'score':164C 'self':34B 'self-host':33B 'server':13A 'signific':142C 'soa':2A,21A,29B,37B,59B,97C,130C,138C,159C 'success':148C 'suit':3A,30B,38B,60B,98C,131C,139C,160C 'suite':22A 'support':106C 'take':11A,57B 'takeov':156C 'updat':89B 'user':10A 'vector':172C 'version':107C 'via':125C 'vulner':93C,117C,134C,152C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91251","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91251:340","url":null,"severity":null,"published_at":"2026-10-23T22:58:29+00:00","modified_at":"2026-10-23T22:58:29+00:00","first_seen_at":"2026-10-23T22:58:29+00:00","fetched_at":"2026-10-23T22:58:29+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc; CVSS 9.9 per Oracle/CVE.org. Patch numbers are in a My Oracle Support doc (login needed), so no fixed version read. No exploitation or PoC found in Armis or the Oracle pages; no social search done."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1705,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91251","title":"CVE Record: CVE-2026-91251","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1703,"url":"https://cve.armis.com/CVE-2026-91251","title":"Armis: CVE-2026-91251","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}