CVE-2026-91216 is a critical vulnerability in the Fabric Layer of Oracle SOA Suite. It lets an unauthenticated attacker with network access over T3 or IIOP take over affected installations.
What Is It
CVE-2026-91216 affects Oracle SOA Suite, part of Oracle Fusion Middleware. The flaw is in the Fabric Layer component. Oracle describes it as "easily exploitable": an unauthenticated attacker with network access over the T3 or IIOP protocols can use it to compromise Oracle SOA Suite. A successful attack can lead to full takeover of the product.
Oracle ([email protected]) reported the vulnerability, and NVD published it on 2026-10-20. Its NVD status is currently "Received."
Why It Matters
The vulnerability has a CVSS 3.1 base score of 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vector breaks down as follows:
- Network attack vector, low complexity: it can be exploited remotely without special conditions.
- No privileges or user interaction required: the attacker does not need credentials or a victim to take any action.
- Scope changed: the flaw is in SOA Suite, but Oracle notes that attacks "may significantly impact additional products."
- High impact on confidentiality, integrity and availability
The exploitability subscore is 3.9 and the impact subscore is 6.0.
Exploitation status: As of 2026-10-20, CVE-2026-91216 is not listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite as affected:
| Product | Affected Version |
|---|---|
| Oracle SOA Suite | 12.2.1.4.0 |
| Oracle SOA Suite | 14.1.2.0.0 |
The attack path is network access over T3 and IIOP. Deployments where these protocols can be reached from untrusted networks have the most direct exposure. The NVD record does not list any CPE entries yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Organizations running Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for the fix and apply it promptly. Because the CVE is not listed in the CISA KEV Catalog, no CISA-mandated required action or due date applies at this time.
The vulnerability description does not list any workaround. Because T3 and IIOP are the stated attack vectors, restricting access to those protocols from untrusted networks may reduce exposure until the update is applied. This is our assessment, not Oracle's guidance, and it does not replace the patch.