---
id: "CVE-2026-91251"
kind: "vulnerability"
aliases: ["CVE-2026-91251"]
title: "Oracle SOA Suite Adapters flaw lets low-privilege users take over server"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle SOA Suite", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-soa-suite", "other", "runtime", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:58:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91251", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:58:29+00:00"}]
---

# Oracle SOA Suite Adapters flaw lets low-privilege users take over server

Oracle SOA Suite (Fusion Middleware) Adapters component: an easily exploitable flaw lets a low-privileged attacker with HTTP network access take over SOA Suite, with scope change that can affect other products. CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle SOA Suite affected 12.2.1.4.0, 14.1.2.0.0 fixed ?

## How to check

Check your SOA Suite version (OPatch lsinventory in the SOA Oracle Home, or the WebLogic console). Versions 12.2.1.4.0 and 14.1.2.0.0 are affected unless the October 2026 CPU Fusion Middleware patch is in the inventory. Patch numbers are in the Fusion Middleware patch availability doc on My Oracle Support.

## Fix

Apply the Oct 2026 CPU patch for Oracle SOA Suite from the Fusion Middleware Patch Availability Document (My Oracle Support, needs a support contract). Specific patch number unknown. Workaround: limit HTTP access to SOA Suite and adapter endpoints to trusted networks and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91251
- 2026-10-23T22:58:29+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists SOA Suite 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware patch doc; CVSS 9.9 per Oracle/CVE.org. Patch numbers are in a My Oracle Support doc (login needed), so no fixed version read. No exploitation or PoC found in Armis or the Oracle pages; no social search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91251 https://www.cve.org/CVERecord?id=CVE-2026-91251
- [mitigation] Armis: CVE-2026-91251 https://cve.armis.com/CVE-2026-91251

## From the sources

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_