Oracle SOA Suite Has Critical Remote Code Execution Flaw
An unauthenticated attacker can take over Oracle SOA Suite via T3 or IIOP protocols, earning a CVSS score of 10.0.
Key points
- The vulnerability affects Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0.
- Attackers need only network access via T3 or IIOP to exploit the flaw.
- Successful exploitation results in full takeover of the suite with scope change.
The National Vulnerability Database has published details for CVE-2026-91216, a critical vulnerability in Oracle SOA Suite. This flaw allows an unauthenticated attacker with network access to fully compromise the application. The issue resides within the Fabric Layer component of Oracle Fusion Middleware.
The vulnerability carries a CVSS 3.1 Base Score of 10.0, indicating critical severity. It impacts confidentiality, integrity, and availability. Attackers can exploit the weakness easily via the T3 or IIOP protocols. No user interaction is required for the attack to succeed.
Technical Context and Impact
The flaw is located in the Fabric Layer of the Oracle SOA Suite product. According to the NVD record, the vulnerability is easily exploitable. An attacker does not need credentials to initiate the exploit. Network access to the service is the only prerequisite for launching the attack.
Successful exploitation results in the complete takeover of Oracle SOA Suite. The NVD notes that attacks may significantly impact additional products due to scope change. This means the compromise could extend beyond the initial target system.
Affected Versions and Scope
Only specific supported versions of Oracle SOA Suite are affected by this vulnerability. The impacted releases are version 12.2.1.4.0 and version 14.1.2.0.0. Organizations running these versions are exposed to the risk. Other versions of the software are not listed as affected in this record.
The vulnerability is classified as having high complexity for confidentiality, integrity, and availability. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This confirms the remote nature and low privilege requirement of the exploit.
What should you do?
Organizations should immediately verify if they are running the affected versions. Network teams should restrict access to T3 and IIOP ports. Monitoring for unusual activity on these protocols is essential. Wait for official vendor guidance before applying any changes.
What to do and how to stay safe: Oracle
- Audit your environment to identify any instances of Oracle SOA Suite versions 12.2.1.4.0 or 14.1.2.0.0.
- Implement network segmentation to limit access to T3 and IIOP ports to trusted internal networks only.
- Monitor logs for unauthorized connection attempts to these ports, which could indicate exploitation attempts.
- Contact Oracle support or check vendor advisories for confirmation of patches once they become available.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Oracle SOA Suite are vulnerable?
The vulnerability affects Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0.
What is the CVSS score for CVE-2026-91216?
The CVSS 3.1 Base Score is 10.0, which is rated as critical.
Does an attacker need credentials to exploit this flaw?
No, the vulnerability allows an unauthenticated attacker to exploit the system.
