Oracle SOA Suite: Takeover via HTTP in Fabric Layer
Summary
A vulnerability in the Fabric Layer component of Oracle SOA Suite (Oracle Fusion Middleware) allows an attacker with a low-privileged account and network access via HTTP to take over the product. The CVSS 3.1 base score is 8.8 (high), with high impact on confidentiality, integrity and availability. Oracle's official text only says "takeover"; some third-party pages claim remote code execution, which is not confirmed. Exploitation is not known to be automated, and the CISA SSVC assessment reports no exploitation.
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
- Component: Fabric Layer
Fixed in
Unknown. Apply the patch or bundle for the relevant release line from Oracle's October 2026 Critical Patch Update advisory.
Workaround
- No workaround is documented by Oracle.
- Interim hardening (not confirmed by Oracle): restrict external HTTP access to the SOA Suite front end with firewall rules or network isolation, and enforce strict role-based access in the Fabric Layer.
Exploitation
- Not listed in CISA KEV.
- EPSS is about 0.45%.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or confirmed in-the-wild exploitation found in research. This is not a confirmed absence.
Our recommendation
- Obtain the October 2026 Oracle CPU advisory and identify the exact patch for 12.2.1.4.0 and 14.1.2.0.0.
- Inventory SOA Suite installations and check whether their HTTP endpoints are reachable from the internet; patch internet-facing systems first.
- Restrict HTTP access to the Fabric Layer to required networks and review which accounts hold valid logins, since any low-privileged user can attempt exploitation.
- Apply the whole October 2026 CPU, as other SOA Suite CVEs in the same batch are more severe, and confirm the patch level afterwards.
- Recheck NVD for the current status and score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- OpenCVE: CVE-2026-91223 app.opencve.io
- Vulners NVD mirror: CVE-2026-91223 vulners.com
- Strix: CVE-2026-91221 (same CPU batch) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:35.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.