An easily exploitable bug in the Fabric Layer component of Oracle SOA Suite lets an unauthenticated remote attacker take over the product over HTTP, and it carries a CVSS 3.1 score of 9.8 (Critical).
What Is It
CVE-2026-91214 is a vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware, in the Fabric Layer component. Oracle describes it as "easily exploitable." An attacker with network access over HTTP can compromise Oracle SOA Suite without any credentials. A successful attack can result in full takeover of the product.
Oracle ([email protected]) published the record on 2026-10-20. NVD lists its status as "Received," which means NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a worst-case profile:
- Attack Vector: Network. It can be reached remotely over HTTP.
- Attack Complexity: Low. No special conditions are needed.
- Privileges Required: None. The attacker does not need to log in.
- User Interaction: None. No victim action is needed.
- Impact: High for confidentiality, integrity and availability.
The exploitability subscore is 3.9 and the impact subscore is 5.9. A remote, unauthenticated flaw that leads to full takeover of a middleware product should be patched first, especially where SOA Suite endpoints are reachable from untrusted networks.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE. KEV does not currently confirm active exploitation, and the supplied sources contain no other exploitation reports.
What's Vulnerable
Oracle lists these supported versions as affected:
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Fusion Middleware) | Fabric Layer | 12.2.1.4.0 |
| Oracle Corporation | Oracle SOA Suite (Fusion Middleware) | Fabric Layer | 14.1.2.0.0 |
NVD has not published any CPE configurations for this record yet.
Patch Status
The NVD record references Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Administrators running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for the fixes that apply to them and install them.
There is no KEV entry, so no CISA required action or federal due date applies right now. Given the 9.8 score and the lack of any authentication requirement, apply the fix promptly. Until it is in place, limit network exposure of SOA Suite HTTP endpoints.
Sources
- NVD: CVE-2026-91214
- Oracle Critical Patch Update Advisory, October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)