One, tracked as CVE-2026-91231, is within the Adapters part, and allows unauthenticated attackers to compromise Oracle SOA Suite leading to its takeover, with potential influence on related merchandise.
Two others have been within the Cloth Layer part of Oracle SOA Suite: CVE-2026-91216 and CVE-2026-91221.
Each are simply exploitable, Oracle stated, and allow an unauthenticated attacker with community entry by way of the T3 or IIOP protocols to compromise Oracle SOA Suite and maybe have an effect on different merchandise too. The bugs seem in supported variations 12.2.1.4.0 and 14.1.2.0.0.
