Oracle SOA Suite: Unauthenticated remote takeover via HTTP in Adapters
Summary
A flaw in the Adapters component of Oracle SOA Suite (Oracle Fusion Middleware) allows an unauthenticated attacker with network access via HTTP to take over the product. Because the scope is changed, the impact can extend to other products and resources reachable from SOA Suite, including databases behind its adapters. The CVSS base score is 10.0 (critical); no exploitation is known at the time of writing.
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
- Note: a third-party summary also lists other SOA Suite releases; verify against Oracle's matrix.
Fixed in
Unknown. Oracle addressed the issue in the October 2026 Critical Patch Update. Check Oracle's advisory for the exact patch or fixed version for your release.
Workaround
- No workaround is given in the CVE record or by Oracle in the sources reviewed.
- Interim option (not a vendor recommendation): block or restrict external HTTP access to SOA Suite endpoints until patched.
Exploitation
- CISA KEV: not listed.
- Oracle states no exploitation of these CVEs.
- No public proof-of-concept found in the sources reviewed.
- EPSS: below 1 percent (Very Low).
Our recommendation
- Inventory all SOA Suite instances, including versions 12.2.1.4.0 and 14.1.2.0.0, and identify any reachable from the internet.
- Apply the October 2026 Oracle Critical Patch Update for your version after checking the exact patch in the advisory.
- If patching must wait, restrict external HTTP access to affected endpoints and monitor logs for unusual requests.
- Patch the whole SOA Suite stack, as other SOA Suite CVEs were fixed in the same update.
- Recheck NVD and CISA KEV regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- Oracle Security Blog: October 2026 Critical Patch Update released blogs.oracle.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- OpenCVE: CVE-2026-91231 app.opencve.io
- Vulners: NVD:CVE-2026-91231 vulners.com
- Threat Frontier: Oracle October 2026 CPU, SOA Suite threatfrontier.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:06.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.