Oracle SOA Suite faces critical unauthenticated data and availability flaw
A critical vulnerability in Oracle SOA Suite allows unauthenticated attackers to modify data or crash systems via HTTP.
Key points
- CVE-2026-91225 is rated critical with a CVSS score of 9.1.
- The flaw affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0.
- Attackers need only network access via HTTP to exploit the vulnerability.
Oracle has disclosed a critical security vulnerability in its SOA Suite product that allows unauthenticated attackers to compromise systems. The flaw, identified as CVE-2026-91225, enables remote exploitation via standard HTTP connections without requiring any user interaction or credentials.
The National Vulnerability Database records this issue with a CVSS 3.1 base score of 9.1, classifying it as critical due to high impacts on both integrity and availability. The vulnerability resides specifically within the Adapters component of Oracle Fusion Middleware, exposing the system to direct network-based attacks.
Context and background
According to the NVD record, the vulnerability is easily exploitable by anyone with network access to the affected service. An attacker can leverage this flaw to cause a complete denial of service, resulting in frequent crashes or system hangs that disrupt business operations entirely.
Beyond service disruption, the flaw permits unauthorized creation, deletion, or modification of critical data. This includes all data accessible to Oracle SOA Suite, potentially leading to significant data integrity breaches or loss of sensitive information stored within the middleware environment.
Who is affected
Two specific supported versions of Oracle Fusion Middleware are affected by this vulnerability. Organizations running Oracle SOA Suite version 12.2.1.4.0 are exposed to this risk, as are those operating version 14.1.2.0.0. These are the only versions listed as vulnerable in the current advisory.
No other versions are mentioned in the source material as being at risk. Users of older unsupported versions or newer releases are not explicitly identified as affected by CVE-2026-91225 in this specific disclosure, but should verify their own patch status independently.
What should you do?
Security teams should immediately audit their environments to identify any instances of Oracle SOA Suite running versions 12.2.1.4.0 or 14.1.2.0.0. Since no fix has been confirmed yet in the provided material, organizations should focus on limiting network access to these services.
Restricting HTTP access to trusted internal networks can reduce the attack surface until a patch is available. Monitor system logs for unusual activity or repeated crash attempts that may indicate exploitation of this unauthenticated vulnerability.
What to do and how to stay safe: Oracle
- Inventory all systems running Oracle SOA Suite to check for vulnerable versions 12.2.1.4.0 and 14.1.2.0.0.
- Implement network segmentation to restrict HTTP access to the Adapters component from untrusted networks.
- Monitor server logs for signs of denial-of-service attacks or unauthorized data modification attempts.
- Prepare to apply patches immediately once Oracle releases an update for CVE-2026-91225.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91225?
The CVSS 3.1 base score is 9.1, which is classified as critical.
Which Oracle products are affected by this vulnerability?
Oracle SOA Suite within Oracle Fusion Middleware, specifically the Adapters component.
Is authentication required to exploit this flaw?
No, the vulnerability allows unauthenticated attackers with network access via HTTP to exploit it.
