Oracle SOA Suite Has Critical Unauthenticated Remote Code Execution Flaw

Oracle Fusion Middleware contains a critical security vulnerability in its SOA Suite component that allows unauthenticated remote attackers to take control of the system. The flaw, tracked as CVE-2026-91235, carries a CVSS score of 9.8 and requires no user interaction or credentials for exploitation.

The vulnerability resides within the Fabric Layer of the Oracle SOA Suite product. According to the National Vulnerability Database record, the issue is easily exploitable by any attacker with network access via HTTP. Successful attacks result in a complete compromise of the affected Oracle SOA Suite instance, impacting confidentiality, integrity, and availability.

Technical Details and Severity

The Common Vulnerability Scoring System version 3.1 assigns this flaw a base score of 9.8, marking it as critical. The vector string indicates that the attack vector is network-based, with low complexity and no privileges required. The impact is high across all three security pillars: confidentiality, integrity, and availability.

This means an attacker does not need to bypass authentication mechanisms or trick a user into performing an action. The vulnerability can be triggered remotely over standard HTTP connections, making it accessible to anyone who can reach the service on the network. The ease of exploitation combined with the severe impact makes this a high-priority issue for administrators.

Affected Versions and Scope

Only specific supported versions of the Oracle SOA Suite are affected by this vulnerability. According to the advisory, version 12.2.1.4.0 and version 14.1.2.0.0 are the confirmed vulnerable releases. Other versions of the Oracle Fusion Middleware or different components are not mentioned in this specific record.

Organizations using these exact versions of the SOA Suite are exposed to remote takeover risks. The Fabric Layer component is the specific part of the software where the weakness exists. Administrators should verify their current installation versions immediately to determine if their environment falls within the affected range.

What should you do?

Security teams should prioritize verifying their Oracle SOA Suite versions against the affected list. If the environment runs version 12.2.1.4.0 or 14.1.2.0.0, the risk of remote compromise is immediate. Network segmentation and access controls should be reviewed to limit HTTP access to the SOA Suite endpoints.

What to do and how to stay safe: Oracle

• Inventory all servers running Oracle SOA Suite to identify instances of versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict network access to the SOA Suite HTTP endpoints to trusted IP addresses only until a fix is available.
• Monitor logs for unusual HTTP traffic patterns that could indicate exploitation attempts against the Fabric Layer.
• Contact Oracle support or check vendor advisories for the availability of patches or temporary mitigations.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle products are affected by CVE-2026-91235?

The vulnerability affects the Oracle SOA Suite product, which is part of the Oracle Fusion Middleware suite.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score is 9.8, which is rated as critical severity.

Can an attacker exploit this without credentials?

Yes, the vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system.