CVE-2026-91536

MediumCVSS 5.0

Published: 20/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Vulnerability in Oracle SOA Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged authenticated attacker with network access via HTTPS can, under difficult conditions, perform unauthorized update, insert or delete operations and cause partial denial of service.

Risk Assessment

May lead to confidentiality and integrity compromise of Oracle SOA Suite data and partial service unavailability. Exploitation requires network access and a low-privileged account, limiting the scope.

Recommendation

Apply Oracle Critical Patch Update fixes for Oracle SOA Suite and restrict network access to HTTPS interfaces to trusted sources.

Other vulnerabilities in Oracle SOA Suite

See all

Original NVD description (English source)

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data as well as unauthorized read access to a subset of Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS