A critical (CVSS 9.8) flaw in the Fabric Layer component of Oracle SOA Suite lets an unauthenticated attacker with network access over HTTP take over the product.
What Is It
CVE-2026-91234 is a vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware, specifically in the Fabric Layer component. Oracle describes it as "easily exploitable." An attacker needs no authentication, only network access via HTTP, to compromise Oracle SOA Suite.
The CVE was published to NVD on 2026-10-20. Oracle ([email protected]) is the source of the record. Its NVD status is currently "Received," so NVD has not finished its own analysis yet.
Why It Matters
Oracle assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High confidentiality, integrity and availability impact
Oracle says a successful attack can result in takeover of Oracle SOA Suite. An attacker needs no credentials and no user interaction, and the attack complexity is low. Any SOA Suite instance reachable over HTTP should therefore be treated as a priority.
Exploitation status: The supplied CISA KEV entry is empty. KEV does not currently confirm active exploitation of CVE-2026-91234, and the supplied sources contain no other exploitation reports.
What's Vulnerable
According to Oracle, these supported versions are affected:
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Oracle Fusion Middleware) | Fabric Layer | 12.2.1.4.0 |
| Oracle Corporation | Oracle SOA Suite (Oracle Fusion Middleware) | Fabric Layer | 14.1.2.0.0 |
The NVD record lists no CPE entries yet.
Patch Status
The NVD record lists one reference for this CVE: Oracle's October 2026 Critical Patch Update advisory. Administrators running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for patch availability and remediation guidance for their versions.
There is no CISA KEV entry, so there is no KEV-mandated required action or due date for this CVE.
Sources
- NVD, CVE-2026-91234
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)