Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
72
CVE-2026-91231
Unauthenticated HTTP takeover in Oracle SOA Suite Adapters
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in the Adapters component of Oracle SOA Suite (Oracle Fusion Middleware) lets an unauthenticated attacker with network access over HTTP compromise the product. Exploitation is described as easy and can take over Oracle SOA Suite, with impact that may extend to additional products. Supported affected releases are 12.2.1.4.0 and 14.1.2.0.0.
What to do: Apply Oracle's update for CVE-2026-91231. Oracle has not listed a fixed version number for the affected releases.
| Product | Affected |
|---|---|
| Oracle SOA Suite | 12.2.1.4.0 and 14.1.2.0.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H