CVE-2026-91218 is a critical (CVSS 9.6) vulnerability in the Fabric Layer of Oracle SOA Suite that a low-privileged attacker with HTTP network access can easily exploit to read, create, modify or delete critical data.
What Is It
CVE-2026-91218 affects the Fabric Layer component of Oracle SOA Suite, part of Oracle Fusion Middleware. Oracle calls it "easily exploitable." An attacker needs only low privileges and network access over HTTP to compromise Oracle SOA Suite. No user interaction is needed.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / None
Why It Matters
A successful attack can give an attacker unauthorized creation, deletion or modification access to critical data or all data that Oracle SOA Suite can reach. It can also give unauthorized access to critical data or complete access to all of that data. Confidentiality and integrity are both rated High.
The scope is "Changed." Oracle notes that although the flaw is in Oracle SOA Suite, attacks may significantly impact additional products. SOA Suite is often used as integration middleware between business systems, so a compromise could spread beyond the SOA deployment itself.
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation. Given the low attack complexity, network reachability and critical score, defenders should still treat it as a high priority.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The vulnerable component is the Fabric Layer, and the attack vector is HTTP. Any SOA Suite instance on these versions that can be reached over the network by authenticated low-privileged users is in scope.
Patch Status
Oracle published the CVE on 2026-10-20. NVD lists its status as "Received," so NVD has not yet completed its own analysis. The only reference is Oracle's October 2026 Critical Patch Update security alert. Administrators should check that advisory for remediation guidance and apply Oracle's fixes for affected SOA Suite versions.
There is no CISA KEV entry for this CVE, so there is no federal required action or due date.
Until patches are applied, the vector data supports these steps:
- Limit HTTP access to SOA Suite to trusted networks.
- Review which accounts hold low-privileged access, since that is all an attacker needs.
Sources
- NVD, CVE-2026-91218
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)