CVE-2026-91233 is a critical flaw (CVSS 9.8) in the Enterprise Scheduling System component of Oracle SOA Suite that lets an unauthenticated attacker with network access over SOAP take over the product.
What Is It
CVE-2026-91233 affects Oracle SOA Suite, part of Oracle Fusion Middleware. The flaw is in the Enterprise Scheduling System component. Oracle calls it "easily exploitable." An attacker with network access can reach it over SOAP without credentials and compromise Oracle SOA Suite.
NVD published the record on 2026-10-20. Its status is "Received," so NVD has not finished its own analysis yet. Oracle is the source of the record.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That gives a base score of 9.8 (CRITICAL), with an exploitability subscore of 3.9 and an impact subscore of 5.9. In plain terms:
- Network-reachable: the attacker only needs network access to the SOAP interface.
- Low complexity: no special conditions are needed for the attack to work.
- No authentication or user interaction: no credentials are needed and no user has to click anything.
- High impact on confidentiality, integrity and availability: a successful attack can take over Oracle SOA Suite.
SOA Suite often handles integration and orchestration between enterprise systems, so a takeover could expose the data and workflows that run through it.
KEV status: The supplied CISA KEV entry is empty. KEV does not currently confirm active exploitation of this CVE, and there is no CISA-mandated required action or due date.
What's Vulnerable
Oracle lists these supported versions of Oracle SOA Suite as affected:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record lists no CPE entries yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update (CPU) advisory as its reference. Administrators running the affected versions should check that advisory for the fix and apply it. The supplied data does not include fixed version numbers or patch IDs. Since the flaw needs no authentication and is reachable over the network, SOAP endpoints exposed to untrusted networks should be patched first.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-91233
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)