Oracle SOA Suite CVE-2026-91251

Requires network-reachable HTTP access to the Adapters component of Oracle SOA Suite plus a low-privileged authenticated account (CVSS PR:L) - exploitation is not fully pre-authentication. Oracle rates it 'easily exploitable' (AC:L) with no user interaction (UI:N) against the affected versions 12.2.1.4.0 and 14.1.2.0.0. The scope change (S:C) means a successful attack can significantly impact additional products connected to SOA Suite, not just SOA Suite itself. The primary limiting factor is the requirement for some valid low-privilege credential or foothold; defenders can reduce exposure by restricting network access to the SOA Suite management/HTTP interfaces and applying the October 2026 CPU patch.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 base score of 9.9 is driven by a favorable-to-attacker vector (AV:N, AC:L, PR:L, UI:N) combined with a scope change (S:C) and full confidentiality, integrity, and availability impact (C:H/I:H/A:H), which Oracle characterizes as 'easily exploitable' and resulting in complete 'takeover of Oracle SOA Suite.' Because PR:L, the attacker needs only low-level authenticated access, and because S:C the impact can extend beyond SOA Suite into connected products, materially raising the blast radius. Signals are incomplete: no EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is currently no evidence of active or at-scale exploitation to corroborate the theoretical severity. The practical limiter is the PR:L authentication requirement - an attacker must first obtain some valid (even low-privilege) credential or foothold, which distinguishes this from a fully pre-auth internet-wormable bug. Note also a metadata conflict: the input Tag labels this 'Information Disclosure,' but the description and CVSS (I:H/A:H, full takeover) describe far more than disclosure - treat the tag as inaccurate and prioritize as a full-compromise issue.

A low-privileged user (or an attacker who has obtained basic application credentials) sends a crafted HTTP request to the vulnerable Adapters component of an exposed Oracle SOA Suite instance. Exploitation requires no user interaction and leads to full takeover of SOA Suite, and because of the scope change, can pivot to significantly impact additional connected products. No public exploit identified at time of analysis, so weaponization effort would currently fall on the attacker.