Oracle SOA Suite: Privilege escalation in Fabric Layer via HTTP
Summary
Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain a vulnerability in the Fabric Layer component. An attacker with low privileges and network access via HTTP can compromise the product, with high impact on confidentiality, integrity and availability. Authentication is required, so the risk depends on how many accounts can reach the affected endpoints.
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
Fixed in
- Apply the Oracle Security Patch for SOA Suite from the October 2026 Critical Patch Update.
- Exact patch identifiers per release: Unknown. Check the SOA Suite table in the Oracle advisory or My Oracle Support.
Workaround
- No vendor workaround known.
- Interim hardening until patching: restrict external HTTP access to the SOA Suite front end using firewall rules or network isolation (generic recommendation, not confirmed by Oracle for this CVE).
Exploitation
- Exploited in the wild: No evidence found; not listed in CISA KEV as of 21 October 2026.
- Public proof of concept: None found.
- EPSS: 0.00447 (low).
- CISA SSVC: Exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether Oracle SOA Suite is installed and whether its HTTP endpoints are reachable from the internet or a broad internal user base.
- Restrict access to the SOA Suite endpoints now as interim hardening.
- Apply the October 2026 Oracle patch for SOA Suite in the same window as the other higher-scored SOA Suite fixes (CVE-2026-91216, CVE-2026-91231).
- Review SOA Suite accounts and remove unneeded low-privileged access.
- Monitor SOA Suite logs for unusual HTTP requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- OpenCVE CVE-2026-91215 app.opencve.io
- Strix CVE-2026-91215 www.strix.ai
- Vulners NVD CVE-2026-91215 vulners.com
- Brandefense Oracle October 2026 CPU brandefense.io
- SecurityOnline Oracle October 2026 CPU securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:36.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.