{"id":"CVE-2026-91225","published":"2026-10-20T22:20:23.043","lastModified":"2026-10-21T18:44:40.020","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle SOA Suite's Adapters component allows unauthenticated attackers over HTTP to modify critical data or cause denial-of-service by exploiting a flaw that does not require prior access or user interaction.","exploitability":"Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no user interaction or special conditions.","blast_radius":"Successful exploitation could lead to unauthorized data modification across all SOA Suite accessible data and repeated service crashes, causing significant integrity and availability impacts.","remediation":"Upgrade Oracle SOA Suite to a fixed version: for 12.2.1.4.x, apply the latest CPU patch released after October 2026; for 14.1.2.0.0, upgrade to at least 14.1.2.0.1 or the minimum patched version specified in Oracle's October 2026 CPU advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","soa-suite","oracle","integrity-loss","dos"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:48:47.503Z"}}