CVE-2026-91224 is a critical vulnerability in the Fabric Layer component of Oracle SOA Suite that lets a low-privileged attacker with HTTP network access take over the product, with possible impact on other products.
What Is It
CVE-2026-91224 affects the Fabric Layer component of Oracle SOA Suite, part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An attacker needs only low privileges and network access over HTTP to compromise Oracle SOA Suite. No user interaction is required.
Oracle assigned a CVSS 3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That breaks down as follows:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / High
Why It Matters
A successful attack can result in full takeover of Oracle SOA Suite. Because the scope is "changed," the vulnerability sits in SOA Suite but attacks may significantly affect other products as well. Confidentiality, integrity and availability are all rated high, so a successful attack can expose data, alter it and disrupt the service.
The CISA Known Exploited Vulnerabilities (KEV) catalog does not list CVE-2026-91224 at the time of writing. The supplied sources do not confirm active exploitation. Still, low complexity, network reachability and the low privilege requirement make this a high-priority patch for any organization running exposed SOA Suite instances.
The NVD record is in "Received" status. It was published on 2026-10-20 and has not been modified since.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record has no CPE entries yet. Teams should check their versions against Oracle's advisory directly.
Patch Status
Oracle addressed this vulnerability in its October 2026 Critical Patch Update (CPU), which the NVD record references. Administrators running affected SOA Suite versions should review the October 2026 CPU advisory and apply the relevant patches.
No CISA KEV entry exists, so there is no federal required action or remediation due date for this CVE at this time.
Sources
- NVD – CVE-2026-91224
- Oracle Critical Patch Update Advisory – October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry found for this CVE)