CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Oracle SOA Suite Fabric Layer, unauthenticated network flaw over T3 and IIOP (CVSS 3.1 10.0), October 2026 Critical Patch Update

cve · CVE-2026-91221 single-source

Coverage
1
first 2026-10-21 → last 2026-10-21
Latest activity
2026-10-21
Oracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
1
1 hosts

Defender insights

What each entry about CVE-2026-91221 tells a defender to do, newest first.

2026-10-21NOTABLEOracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported exploited

Exposure · detection

Story timeline

  1. 2026-10-21Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP
    trending-vulnerabilitiesOracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported exploited

Hunting pivots

Affected products
Oracle Access ManagerOracle E-Business SuiteOracle Identity ManagerOracle JD Edwards EnterpriseOneOracle SOA SuiteOracle WebLogic Server
Tags
patch-availablepre-authvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows · ATT&CK page ↗

Entries about Oracle SOA Suite Fabric Layer, unauthenticated network flaw over T3 and IIOP (CVSS 3.1 10.0), October 2026 Critical Patch Update (1)

2026-10-21 · view entry permalink →

NOTABLECVE-2026-87337 +10NATOA2

Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP

Oracle's Critical Patch Update advisory of 2026-10-20 contains 1295 new security patches (Oracle, 2026-10-20). Its risk matrices score 112 rows at CVSS 3.1 9.0 or higher, and 90 of those, covering 73 distinct CVE ids, are marked as remotely exploitable without authentication with a network attack vector (Oracle, 2026-10-20). Six rows score 10.0: CVE-2026-87337 in the Access Manager Authentication Engine (HTTP), CVE-2026-91231 in the SOA Suite Adapters (HTTP), CVE-2026-91216 and CVE-2026-91221 in the SOA Suite Fabric Layer (T3 and IIOP), CVE-2026-101809 in the E-Business Suite Workflow Notification Mailer (HTTP, 12.2.3 to 12.2.15) and CVE-2026-91299 in the JD Edwards EnterpriseOne Orchestrator security component (HTTP, 9.2.0.0 to 9.2.26.5) (Oracle, 2026-10-20). WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 carry CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3 and IIOP) at 9.8 and CVE-2026-87302 (HTTP) at 9.1; Identity Manager's End User Self Service has CVE-2026-91408 (T3 and IIOP, 9.8) and Access Manager's SAML path CVE-2026-87251 (9.8) (Oracle, 2026-10-20). The advisory states no exploitation for any row and carries only Oracle's standing sentence that it receives reports of attempts to exploit already-patched flaws (Oracle, 2026-10-20). Oracle points to My Oracle Support documents for patch availability (Oracle, 2026-10-20).

This Critical Patch Update contains 1295 new security patches across the product families listed below.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches.

Oracle
vulnerability21 Oct 03:41Zsingle-sourceOpen finding →
Sources: Oracle (Critical Patch Update Advisory, October 2026)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • oracle.com1 (100%)

External references

NVD · cve.org · CISA KEV

All cited sources (1)