Oracle SOA Suite CVE-2026-91216

No special conditions beyond protocol exposure - remote unauthenticated exploitation against Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 via the T3 or IIOP protocols targeting the Fabric Layer component. The limiting factor is network reachability of the T3/IIOP listener: environments that firewall or disable T3/IIOP, or restrict these ports to trusted management segments, materially reduce exposure. No authentication, privileges, or user interaction are required (PR:N/UI:N), so any attacker able to reach the listener can exploit it; the scope change (S:C) means impact is not confined to the SOA Suite host.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a maximum 10.0 and every metric points to worst-case exploitability: network reachable, low attack complexity, no privileges, no user interaction, with a scope change that extends impact beyond SOA Suite into adjacent products. The exposed protocols - Oracle T3 and IIOP - are the classic Oracle Fusion Middleware/WebLogic deserialization attack surface that has repeatedly been weaponized in prior CPU cycles. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so exploitation status is currently 'no public exploit identified at time of analysis'; however, the absence of these signals reflects data gaps rather than low risk, and T3/IIOP RCE-class flaws historically acquire public exploits within days to weeks of an Oracle CPU release. The supplied 'Information Disclosure' tag understates the impact - the description explicitly states full takeover with Confidentiality, Integrity, and Availability all High - so defenders should treat this as remote code execution / full compromise, not merely disclosure. No SSVC decision data was provided. Bottom line: patch immediately and restrict T3/IIOP exposure.

An unauthenticated attacker with network reachability to the SOA Suite's T3 or IIOP listener sends a crafted (likely deserialization) payload to the Fabric Layer, requiring no credentials or user interaction given the AV:N/AC:L/PR:N/UI:N vector. Successful exploitation yields complete takeover of the SOA Suite instance, and the CVSS scope change (S:C) indicates the compromise can pivot into additional connected Oracle products. No public exploit code is identified in the supplied data at the time of analysis, though the T3/IIOP attack surface is historically exploit-prone.