IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle SOA Suite: Unauthorized access and data manipulation in Fabric Layer

CVE-2026-91218Critical 9.6

← All vulnerabilities

Summary

A vulnerability in the Fabric Layer component of Oracle SOA Suite (part of Oracle Fusion Middleware) affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low privileges and network access via HTTP can create, modify or delete critical data and gain access to data accessible through SOA Suite. The scope changes, so the impact can extend beyond SOA Suite, and the CVSS base score is 9.6 (critical). The attack is low complexity and requires no user interaction.

Affected

  • Oracle SOA Suite 12.2.1.4.0
  • Oracle SOA Suite 14.1.2.0.0

Fixed in

  • Apply the October 2026 Critical Patch Update (Oracle Critical Patch Update Advisory, October 2026) for the affected release.
  • Exact patch identifiers: Unknown. Take them from the Oracle advisory.

Workaround

  • None confirmed by Oracle.
  • Generic risk reduction (not a fix): restrict HTTP access to administrative and Fabric Layer endpoints to trusted hosts using network segmentation or firewall rules.

Exploitation

  • Not listed in the CISA Known Exploited Vulnerabilities catalog as of the latest data found (around 21-27 October 2026).
  • No public proof-of-concept confirmed as of the latest sources.
  • Oracle has not stated that the flaw is exploited.
  • An earlier Oracle middleware flaw (CVE-2026-21962) was published as a proof-of-concept shortly after its patch, so similar exposure is possible.

Our recommendation

  • Inventory all SOA Suite instances and their versions (12.2.1.4.0 and 14.1.2.0.0), and check whether they are reachable from the internet or untrusted networks.
  • Apply the October 2026 Critical Patch Update for the relevant version using the exact patch IDs from Oracle's advisory, with priority for internet-facing systems.
  • Until patched, restrict HTTP access to the Fabric Layer to trusted hosts and review accounts with low-privilege access, including weak or unused credentials.
  • Recheck CISA KEV and public proof-of-concept status weekly for the next few weeks.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:21.

Original description (NVD)

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed