Unauthenticated SOAP Attack Can Seize Control of Oracle SOA Suite

Unauthenticated attackers with network access can now seize control of Oracle SOA Suite installations through a critical vulnerability in the Enterprise Scheduling System. The flaw, identified as CVE-2026-91233, allows remote exploitation via the SOAP protocol. Successful abuse results in full takeover of the affected software, compromising confidentiality, integrity, and availability.

Which software versions are affected?

The vulnerability impacts two specific supported versions of Oracle Fusion Middleware's Oracle SOA Suite product. According to the National Vulnerability Database record, versions 12.2.1.4.0 and 14.1.2.0.0 are affected. Other versions of the suite are not listed in the current advisory as vulnerable to this specific issue. Organizations should verify their installed version against this list immediately.

How is the vulnerability exploited?

The flaw resides in the Enterprise Scheduling System component. Attackers do not need valid credentials to exploit this weakness. They can send malicious requests over the network using the SOAP protocol. The National Vulnerability Database describes the vulnerability as easily exploitable. This low barrier to entry means automated scanning tools could potentially identify and exploit the flaw without manual intervention.

What is the severity rating?

The Common Vulnerability Scoring System 3.1 Base Score for CVE-2026-91233 is 9.8. This places the vulnerability in the critical severity range. The vector string indicates network access, low complexity, no privileges required, and no user interaction. Impacts on confidentiality, integrity, and availability are all rated as high. This score reflects the ease of exploitation and the severe consequences of a successful attack.

What is the current status of fixes?

The source material provides technical details about the vulnerability and affected versions but does not confirm the availability of a patch or update. No fix has been confirmed yet in the provided records. Organizations running the affected versions should monitor vendor communications closely for mitigation guidance or security updates. Until a fix is released, exposure remains high for unpatched systems.

What analysts watch for

Teams usually monitor for unusual SOAP traffic originating from external networks. Analysts check for unauthenticated requests targeting scheduling endpoints. They examine logs for signs of remote code execution or privilege escalation attempts. Persistence mechanisms often involve creating new administrative accounts or modifying system configurations. Spread may occur through lateral movement using compromised credentials. Reviewing network logs for anomalous patterns is essential for early detection.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Oracle

• Verify if your environment runs Oracle SOA Suite versions 12.2.1.4.0 or 14.1.2.0.0.
• Restrict network access to the Enterprise Scheduling System endpoints to trusted sources only.
• Monitor SOAP traffic logs for unauthenticated requests or unusual scheduling activities.
• Prepare to apply updates once the vendor provides an official patch for CVE-2026-91233.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-91233?

It is a critical vulnerability in Oracle SOA Suite allowing unauthenticated remote takeover via SOAP.

Which versions of Oracle SOA Suite are vulnerable?

Versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this vulnerability.

Is a patch available for CVE-2026-91233?

The source material does not confirm that a fix or update is currently available.