CVE-2026-91235 is a critical (CVSS 9.8) vulnerability in the Fabric Layer of Oracle SOA Suite that lets an unauthenticated attacker with HTTP network access take over affected installations.
What Is It
CVE-2026-91235 affects the Fabric Layer component of Oracle SOA Suite, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable. An attacker needs only network access over HTTP and no credentials. A successful attack can result in full takeover of Oracle SOA Suite.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Impact: High confidentiality, integrity and availability
NVD published the record on 2026-10-20. Its status is "Received," which means NVD has not yet analyzed it. The score and description come from Oracle as the CNA.
Why It Matters
This flaw is remotely reachable, needs no authentication and no user interaction, and has low attack complexity. Together, those factors earn it a 9.8 base score and a CRITICAL rating. The worst-case outcome is complete compromise of SOA Suite, with high impact to confidentiality, integrity and availability.
The supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE. The sources provided here do not confirm active exploitation. Because the flaw is easy to exploit without authentication, defenders should still treat any network-exposed SOA Suite instance as a priority.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle SOA Suite (Oracle Fusion Middleware)
- Component: Fabric Layer
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record does not list any affected CPEs yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should review that advisory and apply the fixes Oracle provides for this CVE.
There is no CISA KEV entry, so the supplied data contains no federal remediation deadline or required action. Until patches are in place, organizations should check whether SOA Suite HTTP endpoints are exposed to untrusted networks.
Sources
- NVD, CVE-2026-91235
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)