# Oracle SOA Suite vulnerabilities Source: https://junglewise.ai/threats/technologies/soa-suite Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/soa-suite.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 36 vulnerabilities in Oracle SOA Suite: 0 in the last 7 days and 28 in the last 90 days, 18 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91536, was published on 20 October 2026. 27 vulnerabilities in the last four weeks, up from none in the four before. 15 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 27 - Last 90 days: 28 - All time: 36 (18 critical, 0 exploited in the wild) ## About Oracle SOA Suite Oracle middleware platform for building and managing service-oriented enterprise applications. ## Latest Oracle SOA Suite vulnerabilities - [CVE-2026-91536: Oracle SOA Suite data access vulnerability in Fabric Layer](https://junglewise.ai/threats/cve-2026-91536-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (medium, CVSS 5, published 20 Oct 2026) - [CVE-2026-91251: Oracle SOA Suite remote code execution in Adapters](https://junglewise.ai/threats/cve-2026-91251-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91250: Oracle SOA Suite Adapters remote code execution](https://junglewise.ai/threats/cve-2026-91250-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91239: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91239-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 8.8, published 20 Oct 2026) - [CVE-2026-91238: Oracle SOA Suite integrity and availability bypass in Fabric Layer](https://junglewise.ai/threats/cve-2026-91238-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.1, published 20 Oct 2026) - [CVE-2026-91237: Oracle SOA Suite unauthorized access in Fabric Layer](https://junglewise.ai/threats/cve-2026-91237-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-91236: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91236-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91235: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91235-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91234: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91234-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91233: Oracle SOA Suite unauthenticated remote code execution in Enterprise Scheduling System](https://junglewise.ai/threats/cve-2026-91233-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91232: Oracle SOA Suite privilege escalation in Fabric Layer](https://junglewise.ai/threats/cve-2026-91232-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91231: Oracle SOA Suite remote code execution in Adapters component](https://junglewise.ai/threats/cve-2026-91231-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) - [CVE-2026-91230: Oracle SOA Suite unauthorized access in Fabric Layer](https://junglewise.ai/threats/cve-2026-91230-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.3, published 20 Oct 2026) - [CVE-2026-91229: Oracle SOA Suite complete compromise in Fabric Layer](https://junglewise.ai/threats/cve-2026-91229-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-91228: Oracle SOA Suite Fabric Layer data access vulnerability](https://junglewise.ai/threats/cve-2026-91228-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.1, published 20 Oct 2026) - [CVE-2026-91227: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91227-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-91226: Oracle SOA Suite Fabric Layer privilege escalation](https://junglewise.ai/threats/cve-2026-91226-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 7.5, published 20 Oct 2026) - [CVE-2026-91225: Oracle SOA Suite remote code execution in Adapters](https://junglewise.ai/threats/cve-2026-91225-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.1, published 20 Oct 2026) - [CVE-2026-91224: Oracle SOA Suite privilege escalation in Fabric Layer](https://junglewise.ai/threats/cve-2026-91224-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91223: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91223-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 8.8, published 20 Oct 2026) - [CVE-2026-91221: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91221-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) - [CVE-2026-91219: Oracle SOA Suite unauthorized data access in Fabric Layer](https://junglewise.ai/threats/cve-2026-91219-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 8.6, published 20 Oct 2026) - [CVE-2026-91218: Oracle SOA Suite unauthorized data access in Fabric Layer](https://junglewise.ai/threats/cve-2026-91218-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.6, published 20 Oct 2026) - [CVE-2026-91217: Oracle SOA Suite unauthorized data access in Fabric Layer](https://junglewise.ai/threats/cve-2026-91217-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (high, CVSS 8.6, published 20 Oct 2026) - [CVE-2026-91216: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91216-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) ## Most severe Oracle SOA Suite vulnerabilities - [CVE-2026-91231: Oracle SOA Suite remote code execution in Adapters component](https://junglewise.ai/threats/cve-2026-91231-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) - [CVE-2026-91221: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91221-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) - [CVE-2026-91216: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91216-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 10, published 20 Oct 2026) - [CVE-2026-91251: Oracle SOA Suite remote code execution in Adapters](https://junglewise.ai/threats/cve-2026-91251-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91250: Oracle SOA Suite Adapters remote code execution](https://junglewise.ai/threats/cve-2026-91250-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91232: Oracle SOA Suite privilege escalation in Fabric Layer](https://junglewise.ai/threats/cve-2026-91232-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91224: Oracle SOA Suite privilege escalation in Fabric Layer](https://junglewise.ai/threats/cve-2026-91224-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-91236: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91236-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91235: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91235-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) - [CVE-2026-91234: Oracle SOA Suite remote code execution in Fabric Layer](https://junglewise.ai/threats/cve-2026-91234-vulnerability-in-the-oracle-soa-suite-product-of-oracle-fusion) (critical, CVSS 9.8, published 20 Oct 2026) ## Vulnerabilities per week 27 vulnerabilities in the last four weeks, up from none in the four before. 15 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 27 | 15 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Oracle technologies - [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server): 163 vulnerabilities - [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management): 142 vulnerabilities - [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon): 130 vulnerabilities - [Oracle MySQL Cluster](https://junglewise.ai/threats/technologies/mysql-cluster): 129 vulnerabilities - [Oracle Coherence](https://junglewise.ai/threats/technologies/coherence): 113 vulnerabilities - [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite): 110 vulnerabilities - [Oracle WebCenter Content](https://junglewise.ai/threats/technologies/webcenter-content): 110 vulnerabilities - [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search): 104 vulnerabilities - [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager): 102 vulnerabilities - [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools): 101 vulnerabilities - [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools): 101 vulnerabilities - [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se): 92 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Oracle SOA Suite vulnerabilities", https://junglewise.ai/threats/technologies/soa-suite, 9 November 2026.