Oracle SOA Suite CVE-2026-91230 Critical HTTP Flaw Compromises Fabric Layer Data

Oracle has identified a critical security vulnerability in its SOA Suite product that exposes organizations to significant data risks. The flaw, tracked as CVE-2026-91230, affects specific supported versions of the software, including 12.2.1.4.0 and 14.1.2.0.0. Security teams using these versions must assess their exposure immediately.

What happened

The National Vulnerability Database records CVE-2026-91230 as a critical issue within Oracle Fusion Middleware. The vulnerability resides specifically in the Fabric Layer component of the Oracle SOA Suite. According to the NVD record, the flaw is easily exploitable by an unauthenticated attacker with network access via HTTP. This means no credentials are required to attempt exploitation from a remote location.

The CVSS 3.1 Base Score is 9.3, indicating a severe threat level. The vector string confirms network access, low complexity, and no privileges required. The vulnerability allows attackers to compromise the Oracle SOA Suite environment directly. While the entry point is in SOA Suite, the impact can extend to additional products due to scope change.

Why it matters

Successful exploitation of this vulnerability can lead to unauthorized access to critical data. Attackers may gain complete access to all data accessible to Oracle SOA Suite. The NVD description notes that attackers can also perform unauthorized updates, inserts, or deletes on some accessible data. This combination of confidentiality and integrity impacts creates a high-risk scenario for enterprises.

The scope change aspect of the vulnerability is particularly concerning for integrated environments. Attacks may significantly impact additional products beyond the initial target. This means that a breach in the SOA Suite could potentially compromise adjacent systems or data stores. Organizations using versions 12.2.1.4.0 and 14.1.2.0.0 are directly affected.

What to watch

• Monitor network traffic for unusual HTTP requests to SOA Suite endpoints.
• Check for unauthorized data modifications or access logs in the Fabric Layer.
• Verify that no unauthenticated users have accessed critical data recently.
• Review system integrity for signs of scope change impacts on other products.

Signals worth monitoring

Teams usually detect this type of activity by reviewing web server access logs for unauthenticated HTTP requests to sensitive endpoints. Look for spikes in traffic from unknown IP addresses targeting the Fabric Layer. Check application logs for unexpected data modifications or access attempts without valid credentials. Monitor for unusual outbound connections that might indicate data exfiltration. Verify that integrity checks on critical databases show no unauthorized changes. Alert on any new administrative accounts created without proper approval processes.

What to do and how to stay safe: Oracle SOA Suite

• Inventory all instances of Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict network access to SOA Suite endpoints using firewalls until patched.
• Enable detailed logging for HTTP requests to the Fabric Layer component.
• Monitor for unauthorized data access or modifications in real-time.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Oracle SOA Suite are affected by CVE-2026-91230?

The vulnerability affects Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0.

What is the CVSS score for this vulnerability?

The CVSS 3.1 Base Score is 9.3, classified as critical.

Can this vulnerability be exploited remotely?

Yes, it allows unauthenticated attackers with network access via HTTP to exploit the flaw.