Oracle SOA Suite: Privilege escalation in Adapters component
Summary
Oracle SOA Suite (Fusion Middleware, Adapters component) versions 12.2.1.4.0 and 14.1.2.0.0 are affected by CVE-2026-91250, classified as CWE-269 (Improper Privilege Management) in the input data, while OpenCVE lists CWE-284. An attacker with low privileges and network access via multiple protocols can take over Oracle SOA Suite, and because the scope changes, the impact can extend to other products. The attack requires a valid account but no user interaction, and the CVSS base score is 9.9 (Critical).
Affected
- Oracle SOA Suite 12.2.1.4.0
- Oracle SOA Suite 14.1.2.0.0
Fixed in
Unknown. The fix is in Oracle's October 2026 Critical Patch Update (released 20 October 2026). Check the Oracle advisory and My Oracle Support for the exact patch for your version.
Workaround
- Unknown from Oracle. Restricting network access to SOA Suite endpoints to trusted hosts is a stopgap only and must be verified against Oracle's guidance.
Exploitation
- Not listed in CISA KEV.
- EPSS about 0.45%.
- No public proof-of-concept or in-the-wild exploitation found in the research; this does not rule them out.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory all SOA Suite 12.2.1.4.0 and 14.1.2.0.0 instances, including integrations that depend on them.
- Apply the October 2026 CPU patch for your version after confirming it in Oracle's advisory.
- Until patched, limit SOA Suite network access to trusted hosts and review service accounts for weak or shared credentials.
- Check logs for unusual authentication and administrative activity on SOA Suite.
- Verify whether any SOA Suite listener is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- OpenCVE CVE-2026-91250 app.opencve.io
- Vulners CVE-2026-91250 vulners.com
- Strix CVE-2026-91250 www.strix.ai
- CSO Online: Oracle patches 1,295 security vulnerabilities in October www.csoonline.com
- Fortra: October 2026 Oracle Critical Patch Update analysis www.fortra.com
- Oracle SOA Suite 14.1.2 upgrade introduction docs.oracle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:05.
Original description (NVD)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.