SB20261110181 - Multiple vulnerabilities in Oracle SOA Suite

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110181

SB20261110181 - Multiple vulnerabilities in Oracle SOA Suite

Published: November 10, 2026

Security Bulletin ID SB20261110181
CSH Severity
High
Patch available
YES
Number of vulnerabilities 30
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 70% Medium 30%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 30 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-91225)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Adapters component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.


2) Improper input validation (CVE-ID: CVE-2026-91231)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Adapters component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


3) Improper input validation (CVE-ID: CVE-2026-91216)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


4) Improper input validation (CVE-ID: CVE-2026-91221)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


5) Improper input validation (CVE-ID: CVE-2026-91251)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Adapters component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


6) Improper input validation (CVE-ID: CVE-2026-91224)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


7) Improper input validation (CVE-ID: CVE-2026-91232)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


8) Improper input validation (CVE-ID: CVE-2026-91250)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Adapters component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


9) Improper input validation (CVE-ID: CVE-2026-91214)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


10) Improper input validation (CVE-ID: CVE-2026-91234)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


11) Improper input validation (CVE-ID: CVE-2026-91235)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


12) Improper input validation (CVE-ID: CVE-2026-91236)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


13) Improper input validation (CVE-ID: CVE-2026-91233)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Scheduling System component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


14) Improper input validation (CVE-ID: CVE-2026-91218)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


15) Improper input validation (CVE-ID: CVE-2026-91230)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


16) Improper input validation (CVE-ID: CVE-2026-91536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


17) Improper input validation (CVE-ID: CVE-2026-91215)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


18) Improper input validation (CVE-ID: CVE-2026-91223)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


19) Improper input validation (CVE-ID: CVE-2026-91239)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


20) Improper input validation (CVE-ID: CVE-2026-91217)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


21) Improper input validation (CVE-ID: CVE-2026-91219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


22) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.


23) Improper input validation (CVE-ID: CVE-2026-91226)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


24) Improper input validation (CVE-ID: CVE-2026-91227)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


25) Improper input validation (CVE-ID: CVE-2026-91229)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


26) Improper input validation (CVE-ID: CVE-2026-91237)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


27) Covert Timing Channel (CVE-ID: CVE-2026-5598)

CWE-ID: CWE-385 - Covert Timing Channel

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a covert timing channel in FrodoEngine.java in the BC-JAVA core modules when performing cryptographic operations. A remote attacker can measure timing differences to disclose sensitive information.


28) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-42404)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access internal network resources.

The vulnerability exists due to improper input validation in the PolicyReference API when fetching remote policy references from user-supplied URIs. A remote attacker can supply a crafted URI to access internal network resources.

Exploitation requires an application to explicitly call the API to retrieve a policy from a remote URI.


29) Improper input validation (CVE-ID: CVE-2026-91228)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to read and manipulate data.


30) Improper input validation (CVE-ID: CVE-2026-91238)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to modify data and cause limited service disruption.

The vulnerability exists due to improper input validation within the Fabric Layer component in Oracle SOA Suite. A remote authenticated user can exploit this vulnerability to modify data and cause limited service disruption.


Remediation

Install update from vendor's website.

References