Oracle SOA Suite Adapters Face Critical Vulnerability Allowing Takeover

Oracle has disclosed a critical security vulnerability in its SOA Suite product that allows unauthenticated attackers to compromise the system. The flaw, tracked as CVE-2026-91231, resides in the Adapters component of Oracle Fusion Middleware and poses an immediate threat to organizations relying on these integration services.

According to the National Vulnerability Database record, the issue is rated with a CVSS 3.1 Base Score of 10.0. This maximum score reflects high impacts on confidentiality, integrity, and availability. The vulnerability is easily exploitable, meaning attackers do not need complex conditions or credentials to initiate a successful compromise of the affected software.

Technical Details and Impact

The vulnerability allows an attacker with network access via HTTP to compromise the Oracle SOA Suite without any form of authentication. The CVSS vector indicates that the attack complexity is low, no user interaction is required, and no privileges are needed prior to exploitation.

Successful exploitation results in a takeover of the Oracle SOA Suite. The National Vulnerability Database notes that while the flaw is located within Oracle SOA Suite, attacks may significantly impact additional products due to a scope change. This suggests that the breach could extend beyond the initial target system, affecting other connected services or data stores.

Affected Versions and Scope

The vulnerability affects specific supported versions of Oracle Fusion Middleware. According to the advisory, Oracle SOA Suite version 12.2.1.4.0 is vulnerable to this security issue. Additionally, version 14.1.2.0.0 is also confirmed to be affected by the flaw.

Organizations running these specific versions should assume their systems are exposed to unauthenticated remote attacks. The flaw is inherent in the Adapters component, which facilitates communication between different applications and services within the middleware environment. No other versions are mentioned in the current National Vulnerability Database record as being affected.

What should you do?

Security teams should immediately verify which versions of Oracle SOA Suite are deployed in their environments. If version 12.2.1.4.0 or 14.1.2.0.0 is in use, the risk of remote compromise is significant. Until a vendor patch is confirmed and applied, reducing network exposure to these systems is a critical mitigation strategy.

What to do and how to stay safe: Oracle

• Inventory all instances of Oracle SOA Suite to identify if versions 12.2.1.4.0 or 14.1.2.0.0 are present in production or development environments.
• Restrict network access to the Adapters component by implementing strict firewall rules that block HTTP traffic from untrusted or external sources.
• Monitor network logs for unusual HTTP requests targeting the SOA Suite Adapters, which could indicate reconnaissance or exploitation attempts.
• Coordinate with Oracle support to track the release of a security update, and apply the patch immediately once it becomes available.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91231?

The vulnerability has a CVSS 3.1 Base Score of 10.0, which is rated as CRITICAL.

Which Oracle SOA Suite versions are affected?

Versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle SOA Suite are affected by this vulnerability.

Can an attacker exploit this flaw without logging in?

Yes, the vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system.