Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
72
CVE-2026-91216
Unauthenticated takeover in Oracle SOA Suite Fabric Layer
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in the Fabric Layer of Oracle SOA Suite lets an unauthenticated attacker with network access over T3 or IIOP take over the product. Exploitation is described as easy and needs no user interaction. Impact can extend beyond SOA Suite to other products. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected.
What to do: Apply Oracle's update for CVE-2026-91216. No workaround is stated.
| Product | Affected |
|---|---|
| Oracle SOA Suite | 12.2.1.4.0 and 14.1.2.0.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H