CVE-2026-91230 is a critical (CVSS 9.3) vulnerability in the Fabric Layer component of Oracle SOA Suite. An unauthenticated attacker with network access over HTTP can exploit it to compromise the product.
What Is It
CVE-2026-91230 affects the Fabric Layer component of Oracle SOA Suite, which is part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An attacker needs no authentication and no user interaction, only network access via HTTP, to compromise Oracle SOA Suite.
The flaw has a scope change. The bug is in Oracle SOA Suite, but a successful attack may significantly affect other products as well.
Why It Matters
Oracle rates the flaw CVSS 3.1 9.3 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. The vector shows:
- Network attack vector, low complexity: the attack can be launched remotely and needs no special conditions.
- No privileges or user interaction required: an unauthenticated attacker can exploit it directly.
- High confidentiality impact: a successful attack can expose critical data or give complete access to all data Oracle SOA Suite can reach.
- Low integrity impact: the attacker can update, insert or delete some of the data Oracle SOA Suite can reach.
- No availability impact is listed.
SOA Suite is middleware that usually connects business applications and data. The scope change means the impact may reach beyond SOA Suite itself, which makes exposed instances especially sensitive.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. The source data does not confirm active exploitation in the wild. NVD lists the record as "Received" (published 2026-10-20), so further analysis may follow.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite (Oracle Fusion Middleware) as affected:
- 12.2.1.4.0
- 14.1.2.0.0
Affected component: Fabric Layer. The NVD record lists no CPE entries yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update (CPU) advisory as the reference for this vulnerability. Organizations running the affected versions should check that advisory for the fixes and apply them. Until they are deployed, prioritize any SOA Suite instances reachable over HTTP from untrusted networks, because the attack needs no authentication.
There is no CISA KEV entry, so no federal required action or due date applies at this time.