← Back to search

CVE-2026-91225

9.1 CRITICAL

Published 2026-10-20 · Updated 2026-10-21

AI risk analysis

Summary
A vulnerability in Oracle SOA Suite's Adapters component allows unauthenticated attackers over HTTP to modify critical data or cause denial-of-service by exploiting a flaw that does not require prior access or user interaction.
Exploitability
Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no user interaction or special conditions.
Blast radius
Successful exploitation could lead to unauthorized data modification across all SOA Suite accessible data and repeated service crashes, causing significant integrity and availability impacts.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade Oracle SOA Suite to a fixed version: for 12.2.1.4.x, apply the latest CPU patch released after October 2026; for 14.1.2.0.0, upgrade to at least 14.1.2.0.1 or the minimum patched version specified in Oracle's October 2026 CPU advisory.
websoa-suiteoracleintegrity-lossdos

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.