Oracle SOA Suite: Missing authentication in Fabric Layer
Summary
Oracle SOA Suite (component Fabric Layer) versions 12.2.1.4.0 and 14.1.2.0.0 are affected. An unauthenticated remote attacker with network access via HTTP can compromise the product, and the impact can extend to other products (scope change). The CVSS score of 8.6 reflects confidentiality impact only; the record's wording on full access overstates the scored impact.
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
Fixed in
- Fixed in the Oracle October 2026 Critical Patch Update.
- Per-version patch numbers: Unknown. See the Oracle advisory.
Workaround
Unknown. The CVE record lists no vendor workaround.
- Generic hardening, not a vendor workaround: restrict HTTP access to Fabric Layer endpoints to trusted networks.
Exploitation
- Not marked as exploited in the wild in Oracle's risk matrices.
- Not in the CISA KEV catalogue as of 21 Oct 2026.
- Public proof of concept: Unknown.
- EPSS 0.00398 at the time of the snapshot (low).
Our recommendation
- Inventory all SOA Suite 12.2.1.4.0 and 14.1.2.0.0 installations.
- Apply the October 2026 CPU to all of them, including the other Fabric Layer flaws.
- Confirm that no Fabric Layer HTTP or T3/IIOP endpoint is reachable from the internet; restrict access to trusted networks otherwise.
- Review HTTP logs for anomalous access to Fabric Layer endpoints.
- Check NVD for the current status and CWE mapping.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- OpenCVE CVE-2026-91217 app.opencve.io
- Oracle EBS blog: October 2026 CPU blogs.oracle.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- Breach-Signal: Oracle October 2026 CPU breach-signal.com
- ThreatFrontier: Oracle October 2026 CPU threatfrontier.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:30.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.