CVE-2026-91225 is a critical (CVSS 9.1) flaw in the Adapters component of Oracle SOA Suite. An attacker who can reach the service over HTTP can exploit it without logging in to change or delete data and crash the service.
What Is It
CVE-2026-91225 affects the Oracle SOA Suite product of Oracle Fusion Middleware, specifically its Adapters component. Oracle describes it as "easily exploitable." An attacker who can reach the service over HTTP can compromise Oracle SOA Suite without logging in.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H:
- The attack runs over the network.
- The attack is easy to carry out.
- The attacker needs no account and no action from a user.
Oracle submitted the record, and NVD published it on 2026-10-20. Its NVD status is still "Received."
Why It Matters
A successful attack lets an attacker:
- Change or delete data: they can create, delete, or modify critical data, up to all data Oracle SOA Suite can access.
- Take the service offline: they can make Oracle SOA Suite hang or crash repeatedly, so it stops working entirely.
The CVSS score is 9.1 (Critical). Integrity and availability impacts are both rated High. Confidentiality impact is rated None, so the flaw is not rated as letting attackers read data. No login is needed and the attack is easy to carry out. That means anyone who can reach a SOA Suite instance over HTTP could change or wipe the data it handles, or knock it offline.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE, so KEV does not currently confirm that attackers are using it. Watch for a KEV listing, but patch now rather than waiting for one.
What's Vulnerable
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Fusion Middleware) | Adapters | 12.2.1.4.0, 14.1.2.0.0 |
NVD has not yet listed any CPEs (the standard product identifiers scanners use to match vulnerabilities) for this record.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators of affected SOA Suite versions should:
- Read the October 2026 CPU and apply the SOA Suite patches that cover their version.
- Until patched, allow HTTP access to SOA Suite only from trusted networks.
CISA has set no required action or deadline, because no KEV entry exists. The supplied data does not list specific fixed versions, so check Oracle's advisory for patch details.