Oracle SOA Suite CVE-2026-91223

Exploitation requires network access to the Oracle SOA Suite HTTP interface and a valid low-privilege account (CVSS PR:L - authenticated), but no user interaction and no non-default configuration are indicated. The affected component is the Fabric Layer in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0; environments running other versions or without network-exposed SOA Suite HTTP endpoints are not reachable. The primary limiting factor is the authentication requirement (some valid credential/account needed); the primary aggravating factor is low attack complexity with full takeover impact once that minimal access is held.

This is a genuinely high-priority vulnerability on technical merits: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable flaw over HTTP requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity and availability impact ('takeover'). However, the real-world urgency signals are largely ABSENT from the provided data: there is no EPSS score, no CISA KEV listing, and no evidence of public POC/exploit code, so there is no indication of active or imminent exploitation. This fits the typical profile of an Oracle Critical Patch Update item - high severity by design but not yet observed being exploited. The input Tags label this 'Information Disclosure,' which CONFLICTS with the description and CVSS: full takeover with C:H/I:H/A:H is far broader than information disclosure, so that tag understates the impact - treat it as incomplete rather than authoritative. The PR:L metric means some form of valid (even minimal) account/authentication is required, which modestly limits the attacker population versus a fully unauthenticated flaw. Net: prioritize for prompt patching as part of the October 2026 CPU, but there is no current evidence of exploitation driving emergency timelines.

A low-privileged attacker with a valid account and HTTP network access to an exposed Oracle SOA Suite instance sends crafted requests to the Fabric Layer component, exploiting the flaw to escalate to full compromise ('takeover') of the SOA Suite. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once network access and minimal credentials are obtained. No public exploit code has been identified at the time of analysis.