{"id":"CVE-2026-91233","published":"2026-10-20T22:20:24.017","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to completely compromise Oracle SOA Suite through the Enterprise Scheduling System component via SOAP requests. The flaw enables full takeover of the affected system with high impact on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing network-based attacks via SOAP interface with minimal preconditions.","blast_radius":"Successful exploitation could lead to complete compromise of enterprise service orchestration capabilities, potentially affecting critical business processes and data across the organization.","remediation":"Apply the Oracle Critical Patch Update (CPU) for October 2026 which includes the fix for this vulnerability in versions 12.2.1.4.0 and 14.1.2.0.0.","detection":"Monitor for unusual SOAP request patterns to the Enterprise Scheduling System endpoint, particularly those with malformed payloads or unexpected authentication headers, and review application logs for unauthorized access attempts.","tags":["soa","soap","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:53.698Z"}}