CVE-2026-91251 is a critical (CVSS 9.9) vulnerability in the Adapters component of Oracle SOA Suite that lets a low-privileged attacker with HTTP network access take over the product, with impact that can reach other products.
What Is It
CVE-2026-91251 is a vulnerability in Oracle SOA Suite, part of Oracle Fusion Middleware, in the Adapters component. Oracle describes it as "easily exploitable." An attacker needs only low privileges and network access over HTTP. No user interaction is required.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / High
NVD received the record on October 20, 2026. Its status is "Received," so NVD has not yet run its own analysis.
Why It Matters
A successful attack can result in takeover of Oracle SOA Suite. The scope is marked as changed, which means that although the flaw is in SOA Suite, attacks "may significantly impact additional products." The base score is 9.9 (Critical), with an exploitability subscore of 3.1 and an impact subscore of 6.0.
SOA Suite is middleware that connects other enterprise systems, so taking it over could give an attacker a path into the systems it touches. The attacker only needs low-privileged access, which lowers the bar for exploitation.
As of this writing, CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for CVE-2026-91251. The supplied sources do not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Component | Affected Versions |
|---|---|---|---|
| Oracle Corporation | Oracle SOA Suite (Oracle Fusion Middleware) | Adapters | 12.2.1.4.0, 14.1.2.0.0 |
Oracle lists these as the supported versions that are affected. The NVD record does not list any CPE entries yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update advisory as its reference. Organizations running SOA Suite 12.2.1.4.0 or 14.1.2.0.0 should check that advisory for the fix and patching guidance that applies to them, and should prioritize this one given the critical severity and low attack complexity.
CVE-2026-91251 is not in the KEV catalog, so CISA has not set a required action or due date.