A critical, easily exploitable vulnerability (CVSS 9.9) in the Adapters component of Oracle SOA Suite lets a low-privileged attacker with network access take over the product, and the impact can reach other products.
What Is It
CVE-2026-91250 is a vulnerability in the Adapters component of Oracle SOA Suite, part of Oracle Fusion Middleware. Oracle says it is "easily exploitable." An attacker needs network access and low privileges, and can reach the flaw through multiple protocols. No user interaction is needed.
Oracle rates it CVSS 3.1 Base Score 9.9 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The flaw was published to NVD on 2026-10-20. NVD shows its status as "Received," which means NVD has not finished analyzing it yet.
Why It Matters
- Full takeover: A successful attack can result in takeover of Oracle SOA Suite, with high impact to confidentiality, integrity and availability.
- Scope change: The flaw is in SOA Suite, but Oracle says attacks "may significantly impact additional products." A compromise may not stay inside SOA Suite.
- Easy to exploit: Attack complexity is low, no user interaction is needed, and the attacker only needs a low-privileged account and network access.
- Exploitation status: CVE-2026-91250 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation, and CISA has not set a required action or due date.
SOA Suite is integration middleware, so it often connects to other business systems. Because of the scope change, a compromise could reach beyond the SOA Suite host.
What's Vulnerable
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Oracle Fusion Middleware) | Adapters | 12.2.1.4.0, 14.1.2.0.0 |
These are the supported versions Oracle lists as affected. NVD has not published CPE data for this CVE yet.
Patch Status
The NVD record's only reference is Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should read that advisory for fix details and apply the relevant updates.
Because the score is 9.9 and the attack only needs low privileges, treat this as a priority patch. Prioritize SOA Suite instances reachable from untrusted networks. If KEV adds this CVE later, check CISA's required action and due date.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-91250
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)