Oracle SOA Suite: Improper access control in Fabric Layer allows takeover
Summary
Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component. An unauthenticated attacker with network access to the T3 or IIOP protocols can fully compromise the product, with CVSS 3.1 score 10.0. Because of a scope change, attacks may also significantly affect other connected products.
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
Fixed in
- Fix included in Oracle Critical Patch Update October 2026 (released 20 October 2026)
- Patch identifiers and fixed build numbers: Unknown. See Oracle advisory.
Workaround
- Unknown. No official Oracle workaround was retrievable.
- Restrict access to T3 and IIOP from untrusted networks until patched.
- Disable unused SOA Suite components or ports where possible.
Exploitation
- No evidence of active exploitation found at time of writing.
- CVE is not listed in CISA KEV.
- Public proof of concept: Unknown.
- EPSS below 1% in one listing.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Inventory all SOA Suite 12.2.1.4.0 and 14.1.2.0.0 instances, including those bundled with other products.
- Block T3 and IIOP from untrusted networks immediately.
- Apply the October 2026 Oracle CPU and verify the build after patching; prioritise internet-facing systems.
- Review logs for unexpected T3 or IIOP connections.
- Recheck NVD, CISA KEV and the Oracle advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- OpenCVE: CVE-2026-91216 app.opencve.io
- Vulners: CVE-2026-91216 vulners.com
- Fortra: October 2026 Oracle CPU analysis www.fortra.com
- eSecurityPlanet: Oracle October 2026 CPU www.esecurityplanet.com
- CSO Online: Oracle patches 1295 security vulnerabilities www.csoonline.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:07.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.