CVE-2026-91216
CriticalCVSS 10.0Summary
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via T3 or IIOP can take over Oracle SOA Suite, with potential impact on additional products (scope change).
Risk Assessment
Critical risk — no authentication or user interaction required, resulting in full system takeover and potential impact on related products.
Recommendation
Immediately apply Oracle security updates for Oracle SOA Suite. Restrict access to T3/IIOP ports and monitor network traffic.
Other vulnerabilities in Oracle SOA Suite
See all- CVE-2026-91251Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can take over the product, and attacks may significantly impact additional products (scope change).
- CVE-2026-91250Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via multiple protocols can take over the product, and attacks may significantly impact additional products (scope change).
- CVE-2026-91236Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91235Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91234Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91233Critical
Vulnerability in Oracle SOA Suite (Enterprise Scheduling System component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via SOAP to easily compromise and take over Oracle SOA Suite. CVSS 3.1 Base Score 9.8.
- CVE-2026-91232Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows a low-privileged attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91231Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily compromise and take over Oracle SOA Suite, with potential impact on additional products (scope change). CVSS 3.1 Base Score 10.0.
- CVE-2026-91230Critical
Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily gain unauthorized access to critical data or all Oracle SOA Suite accessible data and unauthorized update, insert, or delete access to some data, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.3.
- CVE-2026-91225Critical
Vulnerability in Oracle SOA Suite (Adapters component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows an unauthenticated attacker with network access via HTTP to easily gain unauthorized creation, deletion, or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 9.1.
Original NVD description (English source)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS