Key points
- CVE-2026-91218 affects Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0.
- The flaw allows low-privileged users to create, modify or delete data via HTTP.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.6.
An attacker with basic network access can now compromise Oracle SOA Suite environments by exploiting a newly disclosed vulnerability. The flaw grants the ability to manipulate or erase critical data stored within the system. This capability arises from a weakness in the Fabric Layer component of Oracle Fusion Middleware. Security researchers warn that the impact extends beyond the immediate application, potentially affecting other connected products due to scope changes.
In plain English
The vulnerability sits within the core infrastructure of the Oracle SOA Suite. It allows an individual with low-level privileges to interact with the system over a standard HTTP connection. Once connected, they can bypass normal restrictions to view sensitive information. They can also create new entries, change existing records or remove data entirely. This means an attacker does not need deep system knowledge or high-level credentials to cause significant disruption or data loss.
The background
The National Vulnerability Database lists this issue as CVE-2026-91218. It specifically targets Oracle SOA Suite version 12.2.1.4.0 and version 14.1.2.0.0. The CVSS 3.1 base score is 9.6, which falls into the critical severity range. The vector indicates that the attack is easily exploitable and requires no user interaction. The high scores for confidentiality and integrity reflect the severity of the potential data exposure and modification capabilities available to the attacker.
What changes now
Organisations using the affected versions of Oracle SOA Suite face immediate risk. The ease of exploitation means that the vulnerability is easily exploitable via network access. Because the flaw allows for data modification and deletion, the integrity of business processes relying on this middleware is at stake. Teams must verify their current versions against the affected list. The source material does not confirm if a fix or update exists.
The attacker's path
Teams usually begin by mapping external-facing services to identify exposed middleware components. Check whether legacy interfaces are still active and accessible from untrusted networks. Look for any services running with default or low-privilege accounts that could be leveraged for initial access. Monitor logs for unusual HTTP requests that attempt to create or modify data without proper authentication. Focus on isolating critical data stores from direct network exposure to limit the blast radius.
What to do and how to stay safe: Oracle
- Inventory all instances of Oracle SOA Suite and verify they are not running versions 12.2.1.4.0 or 14.1.2.0.0.
- Restrict network access to the Fabric Layer component using firewalls or access control lists to limit HTTP exposure.
- Monitor server logs for unexpected data creation, modification or deletion events from low-privileged accounts.
- Review account permissions to ensure no unnecessary low-privilege accounts have network access to the suite.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle SOA Suite versions are affected by CVE-2026-91218?
Versions 12.2.1.4.0 and 14.1.2.0.0 are affected.
What is the CVSS score for this vulnerability?
The CVSS 3.1 Base Score is 9.6.
Can an attacker delete data using this flaw?
Yes, successful attacks can result in unauthorized deletion of critical data.
