Oracle SOA Suite: Authentication bypass in Fabric Layer allows takeover
Summary
Oracle SOA Suite (Fusion Middleware, component Fabric Layer) contains a flaw that lets an unauthenticated attacker with network access compromise the product via the T3 or IIOP protocols. Because the scope changes, attacks can also significantly impact other products. Successful exploitation can result in complete takeover of Oracle SOA Suite, and CVSS 3.1 rates it at 10.0 (Critical).
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
- Note: one secondary source lists 14.1.2.1.0; verify against Oracle's advisory.
Fixed in
Unknown. Fixed in the October 2026 Critical Patch Update; check Oracle's advisory for the fixed build numbers.
Workaround
- No workaround provided in the CVE record or by Oracle.
- Third-party guidance suggests restricting network access to Oracle middleware management interfaces.
Exploitation
- Not listed in CISA KEV as of 21 October 2026.
- Oracle reports no exploitation.
- EPSS: 0.00522 (Vulners).
- Public proof-of-concept exploit: unknown.
Our recommendation
- Inventory all SOA Suite instances running 12.2.1.4.0 or 14.1.2.0.0.
- Block T3 and IIOP from untrusted networks and limit them to internal administration hosts.
- Review SOA/WebLogic logs for unexpected T3 or IIOP connections.
- Apply the October 2026 Critical Patch Update after confirming the fixed build in Oracle's advisory.
- Also check CVE-2026-91216 and CVE-2026-91231 in the same advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- OpenCVE CVE-2026-91221 app.opencve.io
- Cyberpress: Oracle releases massive security update cyberpress.org
- CSO Online: Oracle patches 1,295 vulnerabilities in October www.csoonline.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- SecurityOnline: Oracle Critical Patch Update October 2026 securityonline.info
- Fortra: October 2026 Oracle CPU analysis www.fortra.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:07.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.