Oracle SOA Suite CVE-2026-91218

Requires a valid low-privileged account on the target Oracle SOA Suite instance (PR:L) and network reachability to the Fabric Layer component over HTTP (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited to the affected supported versions 12.2.1.4.0 and 14.1.2.0.0; the principal limiting factor is the need for pre-existing authenticated access, so instances that are not internet-exposed or that tightly restrict low-privilege account provisioning present a materially smaller attack surface. The scope change (S:C) means successful exploitation can impact additional integrated products beyond SOA Suite.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) is strong and internally consistent: network-reachable over HTTP, low attack complexity, no user interaction, requiring only low privileges, with a scope change amplifying impact to additional products beyond SOA Suite itself. The combination of PR:L + S:C + C:H/I:H is what drives the 9.6 score - a privileged foothold that breaks out of its security authority. However, several real-world risk signals are MISSING from the provided data: no EPSS probability was supplied, the vulnerability is NOT listed in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Note a tag/vector conflict: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L metric, which explicitly requires the attacker to already hold low-level privileges rather than bypassing authentication - treat the 'Authentication Bypass' label with skepticism and rely on the authoritative Oracle CPU vector. Net: a credible, easily-exploitable escalation/data-compromise flaw in enterprise middleware warranting prompt patching, but with no evidence of active or automated exploitation at this time.

An attacker who holds any low-privileged account on an exposed Oracle SOA Suite instance sends crafted HTTP requests to the Fabric Layer component, abusing the flaw to read and modify critical data beyond their authorization. Because the vulnerability causes a scope change, the compromise extends to additional integrated Oracle products, not just SOA Suite. No public exploit code is identified, but low attack complexity and no required user interaction make reliable exploitation plausible once details are reverse-engineered from the October 2026 CPU.