{"id":"CVE-2026-91234","published":"2026-10-20T22:20:24.130","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical vulnerability in Oracle SOA Suite's Fabric Layer allows unauthenticated attackers to fully compromise the system through HTTP requests. This represents a severe risk as it enables attackers to gain complete control over the affected Oracle SOA Suite instances without needing any credentials.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers with network access to immediately compromise the system through HTTP requests.","blast_radius":"If exploited, this vulnerability could lead to complete takeover of Oracle SOA Suite instances, potentially affecting enterprise integration workflows and business-critical processes across organizations using the affected versions.","remediation":"Upgrade to Oracle SOA Suite 14.1.2.0.0 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["soa","web","critical","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:58.662Z"}}