CVE-2026-91236 is a critical flaw in the Fabric Layer component of Oracle SOA Suite that lets an unauthenticated attacker with network access over HTTP take over affected installations.
What Is It
CVE-2026-91236 is a vulnerability in Oracle SOA Suite, part of Oracle Fusion Middleware. It is in the Fabric Layer component. Oracle describes it as "easily exploitable." An attacker needs only network access over HTTP to compromise the product, with no credentials and no user interaction.
Oracle reported the flaw, and NVD published it on 2026-10-20. The NVD record's status is currently "Received," which means NVD has not yet done its own analysis.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.8 (Critical):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High confidentiality, integrity and availability impact
Oracle says a successful attack can result in takeover of Oracle SOA Suite. Because it is exploitable remotely without authentication and with low complexity, any unpatched instance running 12.2.1.4.0 or 14.1.2.0.0 that is reachable over HTTP is exposed. Internet-facing deployments carry the highest risk.
Exploitation status: The supplied CISA KEV entry is empty. That means CISA has not listed this CVE as known to be exploited, and there is no KEV confirmation of active exploitation. No KEV remediation deadline applies.
What's Vulnerable
According to the vendor data:
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Fusion Middleware) | Fabric Layer | 12.2.1.4.0 |
| Oracle Corporation | Oracle SOA Suite (Fusion Middleware) | Fabric Layer | 14.1.2.0.0 |
These are Oracle's supported versions listed as affected. The NVD record does not list any affected CPEs yet.
Patch Status
Oracle's reference for this CVE is its October 2026 Critical Patch Update (CPU) advisory. Administrators running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for the fixes and apply them. Because the flaw is critical and needs no authentication, prioritize patching any instance exposed over HTTP. There is no CISA KEV required-action entry for this CVE.
Sources
- NVD, CVE-2026-91236
- Oracle Critical Patch Update Advisory; October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)