Oracle SOA Suite CVE-2026-91233

Exploitation requires network access to the SOAP interface of the Oracle SOA Suite Enterprise Scheduling System component on affected versions 12.2.1.4.0 or 14.1.2.0.0. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special non-default configuration are required - the limiting factor is purely network reachability of the SOAP endpoint, so instances behind segmentation or not exposing SOAP to untrusted networks have a materially reduced attack surface.

All available signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and Oracle's own description reinforces this by calling it 'easily exploitable' by an 'unauthenticated attacker with network access via SOAP' resulting in full 'takeover.' These two sources are consistent, which raises confidence that the network/unauthenticated characterization is accurate rather than an artifact of scoring. However, several exploitation-maturity signals are MISSING from the input: no EPSS probability is provided, the vulnerability is NOT listed in CISA KEV, and no POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical conclusion is that the pre-conditions for widespread exploitation are all present (unauthenticated SOAP-facing takeover) even though no exploitation has yet been observed in the supplied data; treat it as a high-priority patch especially where SOA Suite SOAP endpoints are internet- or widely-network-exposed, while recognizing that the real-world exploitation volume cannot be quantified from the available intelligence. One data-quality caveat: the input Tags label this 'Information Disclosure,' which conflicts with the C:H/I:H/A:H full-takeover impact in the description - the tag appears mislabeled and should not be used to downgrade the assessment.

An attacker with network reachability to an Oracle SOA Suite instance sends a crafted SOAP request to the Enterprise Scheduling System component, requiring no authentication and no user interaction. Successful exploitation yields complete compromise (confidentiality, integrity, and availability) and effective takeover of the SOA Suite environment. No public exploit identified at time of analysis, so the scenario reflects the vendor-described capability rather than observed in-the-wild activity.