Oracle SOA Suite CVE-2026-91215

Exploitation requires network access to the Oracle SOA Suite Fabric Layer component over HTTP and a valid low-privileged account on the target (CVSS PR:L) - it is NOT anonymous/unauthenticated. The description specifies affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle SOA Suite within Oracle Fusion Middleware. No user interaction, special non-default configuration, or elevated privileges are needed beyond that low-privilege foothold; the primary limiting factor is possession of low-level authenticated access, which bounds exposure to users/tenants who already have accounts or to environments where such credentials can be obtained.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper finding. The CVSS 3.1 base score of 8.8 is driven by a favorable-to-attacker vector: network attack vector (AV:N) over HTTP, low attack complexity (AC:L), no user interaction (UI:N), and full confidentiality/integrity/availability impact (C:H/I:H/A:H) culminating in complete product takeover. The one meaningful barrier is PR:L - the attacker needs some low-level privilege (a valid low-privileged account), so this is not an anonymous internet-wide mass-exploitation primitive like a PR:N bug would be. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict worth flagging: the input Tags label this 'Information Disclosure,' but the description and CVSS vector describe full takeover with equal I and A impact - the tag understates the true impact. Because this ships in an Oracle quarterly Critical Patch Update (CPU Oct 2026) and Oracle historically does not publish exploitation telemetry, absence of KEV/EPSS/POC reflects limited public intelligence rather than confirmed low risk; treat the patch as priority for internet-facing or multi-tenant SOA Suite deployments.

An attacker who holds a low-privileged account on an Oracle SOA Suite instance sends crafted HTTP requests to the vulnerable Fabric Layer component and escalates to full compromise of the product. No user interaction is required and attack complexity is low, so a single authenticated actor - or an attacker who has phished or otherwise obtained any low-tier credential - can achieve takeover. No public exploit code has been identified at time of analysis.