CVE-2026-91232 is a critical flaw (CVSS 9.9) in the Fabric Layer component of Oracle SOA Suite, part of Oracle Fusion Middleware. Oracle says it is easy to exploit and lets a low-privileged attacker with network access over HTTP take over the product.
What Is It
Oracle reported the vulnerability, and NVD published it on October 20, 2026. Its NVD status is currently "Received." The flaw is in the Fabric Layer component of Oracle SOA Suite. Oracle's description calls it "easily exploitable": an attacker with low privileges and network access via HTTP can compromise Oracle SOA Suite. A successful attack can result in full takeover of the product.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability impact: High / High / High
Why It Matters
This flaw has a 9.9 score, one step below the maximum. Exploiting it needs only low-level credentials and no user interaction. Oracle also flags a scope change: the bug is in SOA Suite, but attacks "may significantly impact additional products." SOA Suite is middleware that connects other applications, so a compromised instance could put connected systems at risk.
As of publication, CVE-2026-91232 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. CISA has not confirmed active exploitation, and there is no KEV-mandated required action or due date. That could change, so watch the KEV catalog.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite (Oracle Fusion Middleware, Fabric Layer component) as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record does not list any affected CPEs yet.
Patch Status
NVD's only reference is Oracle's October 2026 Critical Patch Update advisory. Administrators running the affected versions should check that advisory for the fixes and apply them. Because the flaw can be exploited over the network with low privileges, prioritize SOA Suite instances that are reachable over HTTP. With no KEV listing, no federal remediation deadline applies right now.