Oracle SOA Suite Faces Critical Unauthenticated Remote Vulnerability

A critical flaw in Oracle SOA Suite allows unauthenticated attackers to access critical data via HTTP.

Threat Times Exposure DeskOctober 21, 20262 min read

Illustration: A generic enterprise server sits in a dim room while an open, unsecured network cable dangles from its back port, trailing toward a dark, shadowy void where a faint, — AI-generated illustration: Threat Times

Key points

CVE-2026-91230 carries a CVSS score of 9.3, rated Critical by the NVD.
The flaw affects Oracle Fusion Middleware Fabric Layer components in specific versions.
Attackers can exploit the issue over the network without any prior authentication.

Oracle has disclosed a critical security vulnerability in its SOA Suite product that allows unauthenticated attackers to compromise the system. According to the National Vulnerability Database record for CVE-2026-91230, the flaw is easily exploitable and poses a severe risk to organizations using the affected software versions.

The vulnerability resides within the Fabric Layer component of Oracle Fusion Middleware. The NVD assigns the flaw a CVSS 3.1 Base Score of 9.3, categorizing it as Critical. This high severity rating reflects the ease of exploitation and the significant impact on confidentiality and integrity. Attackers do not need user credentials to trigger the exploit.

Technical Details and Scope

The vulnerability enables an unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. According to the NVD description, successful attacks can result in unauthorized access to critical data. Attackers may also gain complete access to all Oracle SOA Suite accessible data.

Beyond simple data access, the flaw allows for unauthorized update, insert, or delete operations on some of the suite's accessible data. The NVD notes that while the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products due to scope change. This means the blast radius could extend beyond the initial component.

Affected Versions and Exposure

Only specific supported versions of the software are affected by this vulnerability. According to the NVD record, the impacted versions are 12.2.1.4.0 and 14.1.2.0.0. Organizations running these exact versions of Oracle Fusion Middleware are at risk.

The CVSS vector string indicates that the attack vector is Network (AV:N) and the attack complexity is Low (AC:L). Privileges required are None (PR:N), and user interaction is None (UI:N). The scope is changed (S:C), with High impact on Confidentiality (C:H) and Low impact on Integrity (I:L). Availability is not impacted (A:N).

What should you do?

Security teams should immediately inventory their environments to identify any instances of Oracle SOA Suite versions 12.2.1.4.0 or 14.1.2.0.0. Since no patch has been confirmed in the source material, organizations should monitor vendor communications for updates.

Network segmentation can help limit exposure. Restricting HTTP access to the SOA Suite components from untrusted networks may reduce the attack surface. Administrators should review logs for unusual HTTP traffic patterns that could indicate exploitation attempts.

What to do and how to stay safe: Oracle

Audit your environment to confirm if you are running Oracle SOA Suite versions 12.2.1.4.0 or 14.1.2.0.0.
Restrict network access to the affected components to prevent unauthenticated HTTP exploitation.
Monitor server logs for suspicious HTTP requests that may indicate an active exploit attempt.
Prepare to apply updates once the vendor provides a confirmed fix for CVE-2026-91230.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.