Oracle SOA Suite CVE-2026-91237

Requires a network-reachable Oracle SOA Suite instance (versions 12.2.1.4.0 or 14.1.2.0.0) exposing the Fabric Layer component over HTTP; per AV:N/AC:L/PR:N/UI:N no authentication, special configuration, or user interaction is needed against a reachable deployment. The practical limiting factor is network exposure of the SOA Suite HTTP interface - instances segmented behind internal networks, VPNs, or reverse-proxy access controls are not reachable by arbitrary remote attackers, substantially reducing real-world exposure. Impact is confined to confidentiality (data disclosure); the flaw does not enable data modification or denial of service.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, with high confidentiality impact but no integrity or availability impact - i.e. a pure data-exposure issue. This makes it trivially reachable (any HTTP client to the SOA Suite endpoint) but it does not permit data modification or service disruption, so it is a serious information-disclosure risk rather than a full system-compromise/RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization at this time; the signal is driven entirely by the CVSS metrics, not by observed activity. One conflict to note: the input Tags label this 'Authentication Bypass,' yet the description and vector characterize it as unauthenticated access to confidential data (C:H only) with no integrity impact - treat the 'Authentication Bypass' tag with caution, as the primary documented effect is unauthorized data read, not credential/auth-control circumvention. Overall this is a credible patch-soon priority for internet-exposed SOA Suite instances given AV:N/AC:L/PR:N, but the absence of EPSS/KEV/POC data means real-world exploitation likelihood is currently unquantified rather than confirmed high.

An unauthenticated attacker with network access sends a crafted HTTP request to the Oracle SOA Suite Fabric Layer endpoint and retrieves critical or all SOA-accessible data without needing credentials or user interaction. Given AV:N/AC:L/PR:N, the request is simple and repeatable against an exposed instance. No public exploit code is identified in the provided data, so any exploitation would require an attacker to independently develop the technique.