Oracle SOA Suite Adapters Face Critical 9.9 CVSS Flaw in CVE-2026-91250
A critical vulnerability in Oracle SOA Suite adapters allows network attackers to take over the system. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected.
Key points
- CVE-2026-91250 is rated Critical with a CVSS score of 9.9.
- The flaw exists in the Adapters component of Oracle Fusion Middleware.
- Low-privileged attackers with network access can exploit this issue.
The National Vulnerability Database has recorded a critical security flaw in Oracle’s SOA Suite product. Identified as CVE-2026-91250, this vulnerability carries a CVSS 3.1 base score of 9.9. The issue resides within the Adapters component of Oracle Fusion Middleware, exposing systems to significant risk.
This easily exploitable weakness allows a low-privileged attacker with network access to compromise the Oracle SOA Suite. Attackers can utilize multiple protocols to target the system. Successful exploitation results in a full takeover of the affected Oracle SOA Suite instance, granting the attacker complete control.
Technical Severity and Scope
The CVSS vector indicates high impacts on confidentiality, integrity, and availability. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This configuration reflects a network-accessible flaw with low attack complexity and no user interaction required. The scope change designation suggests that while the flaw is in SOA Suite, it may impact additional products.
The severity rating of Critical underscores the immediate danger posed by this vulnerability. With a score of 9.9, it represents one of the highest possible risk levels in the CVSS 3.1 framework. Security professionals should treat this finding with urgent attention due to the ease of exploitation and the potential for total system compromise.
Affected Versions and Products
Only specific supported versions of Oracle SOA Suite are affected by this vulnerability. The impacted releases are version 12.2.1.4.0 and version 14.1.2.0.0. Organizations running these exact versions must verify their exposure. Other versions of Oracle Fusion Middleware or SOA Suite are not listed as affected in this record.
The vulnerability is specific to the Adapters component within the suite. This component facilitates connectivity and integration, making it a frequent target for network-based attacks. The ability to exploit the flaw via multiple protocols increases the attack surface for potential adversaries seeking to leverage this weakness.
What should you do?
Organizations should immediately inventory their environments to identify instances of the affected Oracle SOA Suite versions. Verify whether the Adapters component is active and exposed to network traffic. Monitor logs for unusual activity that may indicate exploitation attempts. Prepare to isolate affected systems if an update is not immediately available.
What to do and how to stay safe
- Audit your environment to confirm if you are running Oracle SOA Suite versions 12.2.1.4.0 or 14.1.2.0.0.
- Restrict network access to the Adapters component using firewalls or access control lists to limit exposure.
- Monitor system logs for signs of unauthorized access or unusual protocol usage targeting the SOA Suite.
- Contact Oracle support to inquire about the status of patches or mitigations for CVE-2026-91250.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
