{"id":"CVE-2026-91235","published":"2026-10-20T22:20:24.243","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical vulnerability in Oracle SOA Suite's Fabric Layer allows unauthenticated attackers to fully compromise the system through HTTP requests, affecting versions 12.2.1.4.0 and 14.1.2.0.0. This represents a severe risk as it enables complete takeover without requiring any authentication credentials.","exploitability":"The vulnerability is easily exploitable with no prerequisites, requiring only network access via HTTP to execute successful attacks that can fully compromise the Oracle SOA Suite instance.","blast_radius":"If exploited, this vulnerability could lead to complete system takeover allowing attackers to access sensitive data, modify business processes, and potentially disrupt critical enterprise operations across the organization.","remediation":"Upgrade to Oracle SOA Suite 14.1.3.0.0 or later to remediate this vulnerability, as the affected versions 12.2.1.4.0 and 14.1.2.0.0 are specifically mentioned as vulnerable.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["soa","web","critical","unauthenticated","rce"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:25:04.680Z"}}