Oracle SOA Suite 12.2.1.4.0/14.1.2.0.0 Enterprise Scheduling System privileges management

Summaryinfo

A vulnerability was found in Oracle SOA Suite 12.2.1.4.0/14.1.2.0.0. It has been classified as critical. Impacted is an unknown function of the component Enterprise Scheduling System. Performing a manipulation results in privileges management. This vulnerability was named CVE-2026-91233. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Oracle SOA Suite 12.2.1.4.0/14.1.2.0.0. This affects an unknown code block of the component Enterprise Scheduling System. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The advisory is shared at oracle.com. This vulnerability is uniquely identified as CVE-2026-91233 since 09/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Oracle

Name

• SOA Suite

Version

• 12.2.1.4.0
• 14.1.2.0.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion