CVE-2026-91221 is a critical flaw in the Fabric Layer of Oracle SOA Suite that lets an unauthenticated attacker with network access over T3 or IIOP take over the product, and its impact can extend to other products.
What Is It
CVE-2026-91221 is a vulnerability in Oracle SOA Suite, part of Oracle Fusion Middleware. It sits in the Fabric Layer component. Oracle describes it as "easily exploitable." An unauthenticated attacker who can reach the T3 or IIOP protocols over the network can compromise Oracle SOA Suite. A successful attack can result in takeover of Oracle SOA Suite.
Oracle reported the CVE ([email protected]), and NVD published it on 2026-10-20. The NVD record's status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 base score is 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That breaks down as:
- Network attack vector, low complexity: the flaw can be exploited remotely without special conditions.
- No privileges and no user interaction required: the attacker needs no credentials, and no victim has to take any action.
- Scope changed: the flaw is in SOA Suite, but attacks may significantly affect additional products.
- High impact on confidentiality, integrity and availability.
KEV status: The supplied CISA KEV entry is empty. This CVE is not confirmed as actively exploited in the Known Exploited Vulnerabilities catalog at this time.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Fabric Layer) | 12.2.1.4.0 |
| Oracle Corporation | Oracle SOA Suite (Fabric Layer) | 14.1.2.0.0 |
Oracle describes these as the affected supported versions. Exploitation requires network access via T3 or IIOP. The NVD record does not yet list any CPE entries.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory, which is the vendor reference for this CVE. Organizations running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for remediation guidance and apply the relevant fixes.
CISA has not set a required action or due date, because the CVE is not in the KEV catalog. Treat it as a priority anyway: it scores CVSS 10.0, needs no authentication and can be reached over the network.