CVE-2026-91231 is a critical, easily exploitable vulnerability in the Adapters component of Oracle SOA Suite that lets an unauthenticated attacker with HTTP access take over the product.
What Is It
CVE-2026-91231 is a vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware, in the Adapters component. Oracle ([email protected]) reported it, and NVD published it on 2026-10-20. Its NVD status is "Received," so NVD has not yet run its own analysis.
According to the vendor description, the flaw is easy to exploit. An unauthenticated attacker who can reach the product over the network via HTTP can use it to compromise Oracle SOA Suite. A successful attack can result in takeover of Oracle SOA Suite.
Why It Matters
Oracle gives the flaw the maximum CVSS 3.1 Base Score of 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In practice, that vector means:
- Network attack vector, low complexity: the flaw can be exploited remotely with no special conditions.
- No privileges or user interaction required: no credentials are needed and no user has to take any action.
- Scope changed: the flaw sits in Oracle SOA Suite, but attacks may significantly affect other products as well.
- High impact to confidentiality, integrity and availability.
The exploitability subscore is 3.9 and the impact subscore is 6.0.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was present in the source data. Active exploitation is not confirmed by KEV at this time. With an unauthenticated, network-reachable flaw scored 10.0, this status is worth watching.
What's Vulnerable
The affected product is Oracle SOA Suite (Oracle Corporation), Adapters component. The affected supported versions are:
- 12.2.1.4.0
- 14.1.2.0.0
NVD has not yet published any CPE configurations for this record.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update security alert. Organizations running the affected SOA Suite versions should read that advisory for remediation guidance and apply the relevant fixes.
No CISA KEV required action or due date applies, because the source data contains no KEV entry for this CVE. Since attackers need only HTTP access and no authentication, defenders should treat any internet-exposed or broadly reachable SOA Suite instance as a priority for remediation.